SC-200 Manage a security operations environment Practice Test 1 — 15 Questions

Question 1

Your SOC team needs to ensure that all high-severity Microsoft Sentinel incidents are automatically assigned to the senior analyst on call. The team uses Microsoft Teams for communication. Which configuration should you implement?

Accepted Answer

Create an automation rule that runs when an incident is created with severity High, sets the owner to the senior analyst, and then runs a playbook to post a message to Teams.. Option D is correct because automation rules in Microsoft Sentinel can directly set the incident owner when an incident is created, and then trigger a playbook to post a message to Microsoft Teams. This two-step configuration ensures high-severity incidents are automatically assigned to the senior analyst on call and the SOC team is notified via Teams without manual intervention.

Answer

Configure an analytics rule to set the incident owner to the senior analyst and enable Teams integration in Sentinel settings.

Answer

Create a playbook that reassigns incidents and posts to Teams, and attach it to an automation rule triggered by high-severity incidents.

Answer

Create a workbook that filters high-severity incidents and configure a Teams webhook in the workbook settings.

Question 2

Your organization uses Microsoft Defender for Cloud Apps to monitor SaaS application usage. You need to generate an alert when a user performs more than 50 failed login attempts in 10 minutes, and the alert must be based on a built-in anomaly detection policy. What should you do?

Accepted Answer

Enable the 'Multiple failed login attempts' anomaly detection policy in Defender for Cloud Apps.. Option D is correct because Microsoft Defender for Cloud Apps includes a built-in anomaly detection policy named 'Multiple failed login attempts' that specifically monitors for a high volume of failed logins from a single user within a short time window. This policy is enabled by default and can be customized to trigger alerts when the threshold (e.g., more than 50 failed attempts in 10 minutes) is exceeded, without requiring any additional configuration or custom policy creation.

Answer

Create a data loss prevention (DLP) policy in Microsoft Purview that triggers on failed logins.

Answer

Deploy a session policy in Defender for Cloud Apps that blocks after 50 failed logins.

Answer

Configure an app connector for each SaaS app and then create a custom activity policy.

Question 3

You are a security analyst at a company that uses Microsoft 365 Defender. You receive an automated email indicating that a user has been flagged for possible credential theft. The email includes a link to investigate the alert in the Microsoft 365 Defender portal. Which role is responsible for sending this email?

Accepted Answer

Microsoft 365 Defender email notification settings.. The automated email alerting a user about possible credential theft is sent by Microsoft 365 Defender's built-in email notification settings. These settings allow security teams to configure notifications for specific alert severities or categories, such as credential theft, directly from the Microsoft 365 Defender portal. The email includes a link to investigate the alert, which aligns with the notification functionality within Microsoft 365 Defender.

Answer

A mail flow rule in Exchange Online configured to forward alerts.

Answer

Microsoft Defender for Cloud Apps notification settings.

Answer

A Microsoft Sentinel analytics rule configured to send email notifications.

Question 4

Your organization uses Microsoft Sentinel and Microsoft Defender for Office 365. You have configured incident creation from Microsoft Defender for Office 365 alerts in Microsoft Sentinel. However, you notice that some alerts are not creating incidents. Which step should you take to troubleshoot this issue?

Accepted Answer

Examine the analytics rule that creates incidents from Microsoft Defender for Office 365 alerts and verify the severity threshold.. Option A is correct because the analytics rule that maps Microsoft Defender for Office 365 alerts to incidents in Microsoft Sentinel includes a severity threshold filter. If the rule is configured to only create incidents for alerts with a severity of 'High' or 'Medium', alerts with 'Low' severity or 'Informational' will be silently dropped and not generate incidents. Verifying and adjusting this threshold directly addresses the root cause of missing incidents.

Answer

Check the Microsoft 365 Defender portal to confirm that the alerts are being generated.

Answer

Review the Microsoft Sentinel workbooks for any visualization errors.

Answer

Verify that the Microsoft Defender for Office 365 data connector in Microsoft Sentinel is connected and data is ingested.

Question 5

Your SOC uses Microsoft Sentinel and Microsoft Defender for Identity (MDI). You have configured MDI to send alerts to Microsoft 365 Defender. From there, Microsoft Sentinel ingests the alerts via the Microsoft 365 Defender connector. You want to ensure that when MDI detects a suspicious activity, the incident in Microsoft Sentinel is created within 5 minutes. Which factors should you consider?

Accepted Answer

The latency depends on the Microsoft 365 Defender connector's polling interval and the analytics rule's frequency.. Option D is correct because the incident creation latency in this architecture depends on two factors: the Microsoft 365 Defender connector's polling interval (which retrieves alerts from Microsoft 365 Defender) and the frequency of the Microsoft Sentinel analytics rule that creates incidents from those ingested alerts. Even if MDI sends alerts quickly to Microsoft 365 Defender, the connector polls at a configurable interval (default every 5 minutes), and the analytics rule runs on its own schedule (typically every 5 minutes). Thus, the total time to incident creation is the sum of these intervals, not a fixed 5 minutes.

Answer

The latency is determined solely by the MDI sensor health and network speed.

Answer

The incident creation time is controlled by the Microsoft Defender for Cloud Apps connector.

Answer

The incident will be created within 5 minutes because MDI writes directly to Microsoft Sentinel.

Question 6

Your organization is implementing Microsoft Sentinel. You need to design a solution to automatically disable a user account in Microsoft Entra ID when a high-severity incident is triggered in Microsoft Sentinel related to that user. Which component should you use?

Accepted Answer

A playbook that uses the Microsoft Graph API to disable the user.. A playbook is the correct component because it is an automated workflow that can be triggered by a Microsoft Sentinel incident. By using the Microsoft Graph API within the playbook, you can programmatically disable a user account in Microsoft Entra ID, which is the required action for a high-severity incident. This aligns with the need for an automated response that integrates Sentinel with identity management.

Answer

An analytics rule that includes a query to disable the user.

Answer

An automation rule that runs a PowerShell script on a hybrid worker.

Answer

A workbook that triggers a webhook to disable the user.

Question 7

Your company uses Microsoft Defender for Cloud to monitor multi-cloud resources. You want to ensure that all critical security recommendations are automatically assigned to the appropriate team leads based on the resource's tags. Which feature should you configure?

Accepted Answer

Use the 'Assign ownership' feature in Microsoft Defender for Cloud to map tags to owners.. Option C is correct because the 'Assign ownership' feature in Microsoft Defender for Cloud allows you to map resource tags to specific owners (e.g., team leads) via an automated rule. When a critical security recommendation is generated for a resource with a matching tag, the recommendation is automatically assigned to the designated owner, ensuring accountability without manual intervention.

Answer

Configure a regulatory compliance standard to send email notifications.

Answer

Create a workbook that lists recommendations and manually assign them.

Answer

Create a governance rule that automatically applies a compliance standard.

Question 8

Your organization uses Microsoft Sentinel and has deployed the Microsoft Sentinel Solution for Microsoft Defender XDR. You need to correlate alerts from Microsoft Defender for Endpoint with Microsoft Defender for Office 365 in a single incident. What is the recommended approach?

Accepted Answer

Use the Microsoft 365 Defender connector to ingest unified incidents from Microsoft 365 Defender, which already correlates alerts from both products.. Option B is correct because the Microsoft 365 Defender connector ingests unified incidents from Microsoft 365 Defender, which natively correlates alerts from Microsoft Defender for Endpoint and Microsoft Defender for Office 365 into a single incident. This is the recommended approach as it leverages the built-in correlation engine in Microsoft 365 Defender, eliminating the need for custom analytics rules or manual correlation.

Answer

Ingest alerts from both products separately and use a KQL query in an analytics rule to correlate them.

Answer

Create a workbook that displays alerts from both products side by side.

Answer

Use a Microsoft Sentinel fusion rule to correlate the alerts.

Question 9

Your SOC uses Microsoft Sentinel and Microsoft Defender for Cloud Apps. You need to configure a policy that triggers when a user downloads a large number of files from SharePoint Online within a short period. Which policy type should you use?

Accepted Answer

Activity policy. An activity policy in Microsoft Defender for Cloud Apps is designed to monitor and respond to specific user activities, such as downloading a large number of files from SharePoint Online within a short period. This policy type allows you to set thresholds and triggers based on user actions, making it the correct choice for detecting anomalous download behavior.

Answer

Session policy

Answer

File policy

Answer

Anomaly detection policy

Question 10

Which TWO actions can you perform using Microsoft Sentinel automation rules?

Accepted Answer

Assign an incident to a specific analyst.. Option B is correct because Microsoft Sentinel automation rules can directly assign an incident to a specific analyst using the 'Assign owner' action. This allows security operations teams to automatically route incidents to the appropriate personnel based on criteria such as severity, tactic, or entity, improving response efficiency.

Answer

Create a new analytics rule based on an incident.

Answer

Modify the data connector's polling interval.

Answer

Automatically create an incident from a log event.

Question 11

Which THREE components are required to ingest Microsoft Entra ID (Azure AD) audit logs into Microsoft Sentinel?

Accepted Answer

A user account with Security Administrator or Global Administrator role to configure the connector.. Option B is correct because configuring the Microsoft Entra ID (Azure AD) data connector in Microsoft Sentinel requires a user account with at least the Security Administrator role (or Global Administrator) to grant the necessary permissions for the connector to read audit logs and sign-in logs from Microsoft Entra ID via the Microsoft Graph API. Without this role, the connector cannot authenticate and retrieve the required data.

Answer

A Log Analytics workspace in the same region as Microsoft Entra ID.

Answer

A playbook to parse the audit logs.

Question 12

Which TWO capabilities are provided by Microsoft Copilot for Security within the Microsoft Sentinel experience?

Accepted Answer

Suggest KQL queries based on a description of what you want to detect.. Option A is correct because Microsoft Copilot for Security in Microsoft Sentinel can generate KQL queries from natural language descriptions, allowing analysts to quickly create detection rules without manually writing KQL syntax. This capability leverages AI to interpret the analyst's intent and produce a query that matches the described detection logic.

Answer

Deploy a new workbook template from a description.

Answer

Modify an existing playbook by adding steps through natural language.

Answer

Automatically create an automation rule based on a chat prompt.

Question 13

Refer to the exhibit. You are reviewing a Microsoft Sentinel automation rule created via ARM template. You notice that the rule is not triggering the playbook when a high-severity incident is created. What is the most likely cause?

Accepted Answer

The condition syntax is invalid; automation rules in ARM templates require specific operator properties.. Option D is correct because automation rules in ARM templates require explicit operator properties (e.g., 'Equals', 'Contains') in the condition syntax. If the condition is written without these operators or uses invalid JSON structure, the rule will fail to evaluate triggers correctly, preventing the playbook from being invoked when a high-severity incident is created.

Answer

The playbook resource ID is missing the 'locations' parameter.

Answer

The automation rule is disabled by default and needs to be enabled.

Answer

The playbook does not have a trigger for Microsoft Sentinel.

Question 14

Refer to the exhibit. You are a security analyst reviewing a KQL query in Microsoft Sentinel. The query is intended to show the count of high-severity malware alerts in the last 24 hours. However, the query returns results only for alerts with exact severity string 'High', but you also need to include 'Informational' severity alerts that are related to malware. What should you modify?

Accepted Answer

Change the 'where AlertSeverity == "High"' to 'where AlertSeverity in ("High", "Informational")'.. Option C is correct because the query currently filters only for alerts where AlertSeverity equals 'High', but the requirement is to also include 'Informational' severity alerts related to malware. By changing the condition to 'where AlertSeverity in ("High", "Informational")', the query will return both severity levels while keeping the malware-related filter and the 24-hour time window intact.

Answer

Remove the 'summarize' and 'order by' clauses.

Answer

Remove the 'where AlertName contains "malware"' condition.

Answer

Change 'ago(24h)' to 'ago(48h)'.

Question 15

Refer to the exhibit. You are running a PowerShell script to enable the Anomalies setting in Microsoft Sentinel. After running the script, you check the Sentinel settings in the portal and see that Anomalies is still disabled. What is the most likely reason?

Accepted Answer

The cmdlet 'Set-AzSentinelSetting' does not exist in the Az module.. The cmdlet 'Set-AzSentinelSetting' does not exist in the official Az.SecurityInsights module. Microsoft Sentinel settings, including Anomalies, are managed via the REST API or the 'Update-AzSentinelSetting' cmdlet (part of the Az.SecurityInsights preview module). Running a non-existent cmdlet would produce an error, not apply any changes, leaving Anomalies disabled in the portal.

Answer

The user does not have Contributor permissions on the workspace.

Answer

The script requires the -PassThru parameter to apply changes.

Answer

The workspace was not retrieved correctly because the name is misspelled.