SC-200 Manage a security operations environment Practice Test 10 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel for security operations. You need to ensure that a specific AWS CloudTrail log is ingested into Microsoft Sentinel. Which data connector should you use?

Accepted Answer

Amazon Web Services S3 Connector. The Amazon Web Services S3 Connector is the correct choice because AWS CloudTrail logs are stored as JSON files in an S3 bucket. Microsoft Sentinel ingests these logs by connecting directly to the S3 bucket, reading the CloudTrail log files, and pulling them into the Log Analytics workspace. The AWS CloudTrail Connector, by contrast, is a legacy connector that requires a separate AWS Lambda function and is deprecated in favor of the S3 connector.

Answer

AWS CloudTrail Connector

Answer

Azure Functions (AWS)

Answer

AWS Security Hub Connector

Question 2

Your security team receives alerts from Microsoft Defender for Cloud. You need to configure automated response to remediate a specific alert type. What should you create in Microsoft Sentinel?

Accepted Answer

An automation rule. In Microsoft Sentinel, automation rules are the correct mechanism to define automated responses triggered by alerts, including those from Microsoft Defender for Cloud. They allow you to run playbooks, change incident severity, assign ownership, or add comments when a specific alert type fires, enabling remediation without manual intervention.

Answer

An analytics rule

Answer

A workbook

Answer

A watchlist

Question 3

You are managing a Microsoft Sentinel workspace that ingests data from Microsoft 365 Defender. You notice that some incident creation rules are not generating incidents as expected. What should you check first?

Accepted Answer

The Microsoft 365 Defender data connector. The Microsoft 365 Defender data connector is the correct first check because it is the ingestion pipeline for security alerts from Microsoft 365 Defender into Microsoft Sentinel. If this connector is misconfigured, disconnected, or has stopped syncing, incident creation rules that depend on these alerts will not trigger, even if the analytics rules themselves are enabled and correctly configured.

Answer

The workspace daily usage cap

Answer

The SecurityIncident table schema

Answer

The analytics rule status

Question 4

Which TWO actions should you take when configuring Microsoft Sentinel to minimize false positives from an analytics rule?

Accepted Answer

Map entities correctly. Mapping entities correctly (Option B) helps minimize false positives by ensuring that alerts are properly correlated with actual assets, reducing noise from unrelated events. Adjusting the rule's query threshold (Option D) allows you to tune the sensitivity of the rule, so only events that exceed a certain count or frequency trigger alerts, filtering out benign or low-frequency activities. These two actions directly reduce false positives, while the other options (playbooks, automatic incident creation, alert grouping) are more about response or organization rather than minimizing false positives.

Answer

Add a playbook to automatically close low-severity alerts

Answer

Enable incident creation automatically

Answer

Configure alert grouping

Question 5

Which THREE of the following are valid methods to archive logs in Microsoft Sentinel to reduce costs?

Accepted Answer

Configure continuous export to Azure Data Lake Storage Gen2. Microsoft Sentinel supports continuous export of logs to Azure Data Lake Storage Gen2, which allows you to retain raw log data at lower storage costs while still being able to query it using Azure Synapse or other analytics tools. This method reduces the cost of high-volume log retention in Sentinel's native workspace by moving data to a cheaper long-term storage tier.

Answer

Set the workspace to free tier

Answer

Enable Basic Logs ingestion for all tables

Question 6

Which TWO permissions are required for a user to manage Microsoft Sentinel playbooks?

Accepted Answer

Logic App Contributor. Microsoft Sentinel playbooks are built on Azure Logic Apps, so managing them requires the Logic App Contributor role to create, edit, and delete the underlying logic app resources. Additionally, Microsoft Sentinel Contributor is needed to attach playbooks to analytics rules or automation rules within Sentinel, as this involves modifying Sentinel-specific configurations. Without both roles, a user cannot fully manage playbooks in the Sentinel context.

Answer

Microsoft Sentinel Reader

Answer

Automation Operator

Answer

Global Administrator

Question 7

Refer to the exhibit. You run the KQL query in Microsoft Sentinel to identify analysts with high incident assignments. The query returns no results, but you know incidents exist. What is the most likely reason?

Accepted Answer

Incidents are not assigned to any owner, so the Owner field is null. If incidents have no assigned owner, the Owner field is null. The KQL query likely filters or groups by Owner, and null values are excluded from results by default in aggregation operations like summarize. Since incidents exist but are unassigned, the query returns no results.

Answer

The summarize operator is incorrectly used

Answer

The SecurityIncident table does not exist

Answer

The query period is too short to capture incidents

Question 8

Refer to the exhibit. You execute the Azure CLI command to create an analytics rule in Microsoft Sentinel. The rule is created but never triggers. What is the most likely cause?

Accepted Answer

The query references a column that does not exist in SigninLogs. If the KQL query in the analytics rule references a column that does not exist in the SigninLogs table, the query will run but return zero results (or an error depending on the query structure), causing the rule to never trigger an alert. In Microsoft Sentinel, analytics rules rely on the query to produce matching results; if the column name is misspelled or absent, no events will match the rule conditions, so no incidents are generated.

Answer

The --enabled parameter should be set to false

Answer

The severity must be set to Low for the rule to trigger

Answer

The resource group name is incorrect

Question 9

Your organization uses Microsoft Defender for Identity (MDI) to monitor on-premises Active Directory. You want to forward MDI alerts to Microsoft Sentinel. What should you configure?

Accepted Answer

Microsoft Defender for Identity connector. Microsoft Defender for Identity (MDI) alerts are forwarded to Microsoft Sentinel by configuring the Microsoft Defender for Identity data connector. This connector ingests MDI security alerts, such as suspicious Kerberos activity or lateral movement attempts, directly into Sentinel for advanced correlation and incident response. The connector uses the Microsoft Graph Security API to pull alerts from the MDI service, enabling seamless integration without additional agents.

Answer

Microsoft 365 Defender connector

Answer

Azure Advanced Threat Protection connector

Answer

Microsoft Defender for Cloud Apps connector

Question 10

You are responsible for Microsoft Sentinel pricing. You notice that data ingestion costs are high due to verbose logs from Windows security events. You need to reduce costs while still collecting critical security events. What should you do?

Accepted Answer

Configure Windows Security Events via AMA connector with event filtering. The Azure Monitor Agent (AMA) connector for Windows Security Events allows granular filtering of event IDs and levels, enabling you to collect only critical security events (e.g., 4624, 4625) while excluding verbose logs like Event ID 5156 (Windows Filtering Platform permit connections). This reduces ingestion volume and cost without losing essential security visibility.

Answer

Use Common Event Format (CEF) connector instead of Windows Events

Answer

Change the table plan to Basic Logs

Answer

Increase the workspace retention period to archive warm data

Question 11

Your team uses Microsoft Sentinel workbooks to visualize security data. You want to allow team members to customize a workbook without affecting the original. What should you do?

Accepted Answer

Create a copy of the workbook and save it as a custom workbook. Creating a copy of the workbook and saving it as a custom workbook allows team members to modify their own version without altering the original. In Microsoft Sentinel, workbooks are based on Azure Monitor Workbooks, and saving a copy creates an independent resource with its own settings and queries. This preserves the original workbook for reference or reuse while enabling customization.

Answer

Edit the original workbook to add personalization

Answer

Assign the team the Microsoft Sentinel Reader role

Answer

Share the workbook directly with the team

Question 12

Which THREE are valid incident management features in Microsoft Sentinel?

Accepted Answer

Incident creation from analytics rules. Incident creation from analytics rules is a core feature in Microsoft Sentinel. When an analytics rule detects a threat or suspicious activity, it automatically generates an incident, which serves as the primary object for investigation and response. This automation is fundamental to Sentinel's security orchestration, automation, and response (SOAR) capabilities.

Answer

Incident merging

Answer

Incident templates

Question 13

Which TWO are supported methods to ingest syslog data into Microsoft Sentinel?

Accepted Answer

Common Event Format (CEF) connector. The Common Event Format (CEF) connector is a supported method because it uses a syslog daemon on a Linux log collector to receive CEF-formatted syslog messages over UDP/TCP (port 514 or 25226) and forwards them to the Log Analytics workspace via the Log Analytics agent. This connector specifically parses CEF headers and maps fields to Sentinel's schema, making it a native ingestion path for security appliances like Palo Alto Networks or Fortinet.

Answer

Logstash output plugin

Answer

Azure Event Hubs

Answer

Direct Azure Monitor Agent ingestion without connector

Question 14

Your Microsoft Sentinel workspace has multiple analytics rules generating incidents. You need to ensure that when an incident is created from a specific rule, a Teams message is sent to the security team. What should you configure?

Accepted Answer

Create an automation rule that runs a playbook when the incident is created. Automation rules in Microsoft Sentinel can trigger on incident creation and execute a playbook, which can be configured to send a Teams message via a connector. This provides a native, low-code way to automate notifications without custom code or external tools.

Answer

Configure a workbook to send an email when an incident appears

Answer

Modify the incident creation rule in Microsoft 365 Defender

Answer

Add a custom analytics rule that triggers on incident creation

Question 15

Your organization uses Microsoft Sentinel with a pay-as-you-go pricing tier. You need to reduce costs by archiving older logs that are rarely accessed. Which action should you take?

Accepted Answer

Configure a lifecycle management policy in Azure Storage to transition logs to the archive tier after the retention period.. To archive old logs that are rarely accessed, you should configure a lifecycle management policy in Azure Storage associated with your Log Analytics workspace. This policy can transition logs to the archive tier after the workspace's retention period ends, reducing storage costs while keeping data available for compliance. Option A (Basic Logs) reduces ingestion costs but does not archive logs; it still retains logs in an accessible but limited query state. Option C (reducing retention) would delete logs after 30 days, not archive them. Option D (Data Collection Rule) filters logs before ingestion, which reduces volume but does not archive existing logs.

Answer

Switch the Log Analytics workspace to Basic Logs tier for the Sentinel tables.

Answer

Reduce the workspace retention period from 90 days to 30 days.

Answer

Create a Data Collection Rule to filter out logs before ingestion.