SC-200 Manage a security operations environment Practice Test 10 — 15 Questions

Question 1

Your company uses Microsoft Defender for Endpoint (MDE) and Microsoft Sentinel. You need to ensure that when a device is determined to be compromised, the device is automatically isolated from the network and a Sentinel incident is updated with the isolation status. What is the most efficient way to achieve this?

Accepted Answer

Create a Microsoft Sentinel automation rule with a playbook that isolates the device and updates the incident. Option D is correct because it leverages Microsoft Sentinel's automation capabilities to respond to security incidents without manual intervention. By creating an automation rule that triggers a playbook (an Azure Logic Apps workflow), you can automatically isolate a compromised device via Microsoft Defender for Endpoint APIs and simultaneously update the Sentinel incident with the isolation status. This provides the most efficient, end-to-end automated response directly within the security operations workflow.

Answer

Have the SOC analyst manually isolate the device from the MDE console and update the incident in Sentinel

Answer

Configure Microsoft Intune to automatically isolate the device when a compliance policy is violated

Answer

Use Microsoft Defender XDR conditional access to block the device

Question 2

A junior SOC analyst receives multiple low-severity alerts from Microsoft Sentinel. The alerts are related to failed logon attempts from a single IP address over a short period. The analyst wants to group these alerts into a single incident to reduce noise. What should the analyst do?

Accepted Answer

Configure the analytics rule to group alerts into incidents by the IP address. Option B is correct because incident grouping in analytics rules allows merging of alerts into a single incident based on criteria like IP address. Option A is wrong because manually grouping is not scalable. Option C is wrong because the incident queue does not have a built-in grouping feature. Option D is wrong because automation rules do not group alerts; they act on incidents.

Answer

Use the Microsoft Defender XDR incident queue to group the alerts

Answer

Create an automation rule to close duplicate alerts

Answer

Manually merge the alerts into one incident in the Sentinel incidents blade

Question 3

Your organization has deployed Microsoft Sentinel and Microsoft Defender XDR. You need to ensure that all Defender XDR incidents are automatically synchronized into Microsoft Sentinel for a single pane of glass. What should you configure?

Accepted Answer

Enable the Microsoft Sentinel data connector for Microsoft Defender XDR. Option A is correct because the Microsoft Sentinel data connector for Microsoft Defender XDR is the native integration that automatically synchronizes all Defender XDR incidents into Sentinel. This connector ingests incidents, alerts, and evidence from Defender XDR into the Sentinel workspace, enabling a single pane of glass without requiring custom scripting or manual workflows.

Answer

Use Microsoft Graph API to sync incidents daily

Answer

Create an automation rule in Microsoft Sentinel to create incidents from Defender XDR alerts

Answer

Configure Microsoft Defender XDR to forward incidents to Sentinel using a webhook

Question 4

A security operations center (SOC) uses Microsoft Sentinel for log management. The SOC manager wants to reduce storage costs by automatically archiving logs that are older than 90 days to long-term retention, but retains the ability to search them if needed. What should the manager configure?

Accepted Answer

Configure a data archiving policy in the Log Analytics workspace to archive logs after 90 days. Option C is correct because configuring a data archiving policy in the Log Analytics workspace automatically moves logs older than 90 days to long-term, low-cost storage while keeping them searchable via the search job or restore feature. This directly meets the SOC manager's requirement to reduce costs without losing the ability to query archived data.

Answer

Change the table plan to Basic Logs for logs older than 90 days

Answer

Create a retention policy that deletes logs older than 90 days

Answer

Export logs older than 90 days to an Azure Storage account

Question 5

Your SOC team uses Microsoft Sentinel incident investigation. An analyst needs to quickly see all related entities (users, IPs, machines) for an incident. Which feature should the analyst use?

Accepted Answer

Incident investigation graph. The Incident investigation graph in Microsoft Sentinel provides a visual, interactive map of all entities (users, IPs, machines) linked to an incident, allowing analysts to quickly see relationships and pivot between entities. This is the dedicated feature for entity-centric incident exploration, unlike other options that serve different purposes.

Answer

Incident timeline

Answer

Hunting blade

Answer

Entity behavior analytics page

Question 6

A SOC analyst suspects a user account is compromised based on anomalous sign-in activity detected by Microsoft Entra ID Protection. The analyst needs to confirm and contain the threat. What is the first action the analyst should take?

Accepted Answer

Review the user's risk level and sign-in logs in Microsoft Entra ID Protection. Option B is correct because the first step when investigating a potential account compromise is to review the user's risk level and sign-in logs in Microsoft Entra ID Protection. This allows the analyst to confirm the threat by examining risk detections, sign-in patterns, and contextual details before taking any containment actions. Prematurely resetting passwords or disabling accounts could disrupt legitimate user activity or alert the attacker without a full understanding of the scope.

Answer

Reset the user's password immediately

Answer

Disable the user account in Microsoft Entra ID

Answer

Block the user's sign-in from all locations

Question 7

Which TWO actions can be performed using Microsoft Sentinel automation rules? (Select TWO.)

Accepted Answer

Assign an incident to a specific SOC analyst. Options A and C are correct because automation rules can assign incidents to owners and run playbooks. Option B is wrong because automation rules do not create analytics rules. Option D is wrong because automation rules do not modify data connectors. Option E is wrong because automation rules do not create watchlists.

Answer

Modify a data connector's configuration

Answer

Create a new analytics rule

Answer

Create a new watchlist

Question 8

Which THREE capabilities are provided by Microsoft Sentinel's UEBA (User and Entity Behavior Analytics)? (Select THREE.)

Accepted Answer

Identify users whose behavior deviates from their peers. Option A is correct because Microsoft Sentinel's UEBA uses machine learning models to establish a baseline of normal behavior for each user and then compares individual user activity against peer group behavior. When a user's actions deviate significantly from their peers, such as accessing unusual resources or performing atypical data transfers, an anomaly is generated, enabling security analysts to investigate potential insider threats or compromised accounts.

Answer

Automatically run playbooks when anomalies are detected

Answer

Create watchlists for high-value users

Question 9

Which TWO actions can be taken directly from the Microsoft Defender XDR incident queue? (Select TWO.)

Accepted Answer

Isolate a device involved in the incident. Option A is correct because the Microsoft Defender XDR incident queue provides direct actions, including device isolation, to contain threats without navigating to separate device management consoles. This capability is built into the incident investigation pane, allowing security analysts to quickly isolate a device involved in an incident from the unified queue.

Answer

Modify a data connector's log collection

Answer

Create a new analytics rule

Answer

Create an automation rule

Question 10

Refer to the exhibit. You are reviewing an automation rule configuration in Microsoft Sentinel. Based on the JSON snippet, what will happen when a high-severity incident is created?

Accepted Answer

The rule will run a playbook when a high-severity incident is created. Option A is correct because the automation rule's trigger condition is set to 'When incident is created' and the condition filters for incidents with a severity of 'High'. When a high-severity incident is created, the rule will execute the associated playbook, which is a common use case for automated response in Microsoft Sentinel.

Answer

The rule will change the severity of the incident to Medium

Answer

The rule will assign the incident to the SOC manager

Answer

The rule will run the playbook when a new alert is created

Question 11

Refer to the exhibit. You are investigating a user entity in Microsoft Sentinel. The entity details show a riskLevel of 'high' and riskState 'atRisk'. What does this indicate?

Accepted Answer

The user account has been flagged by Microsoft Entra ID Protection as at risk. Option C is correct because the riskLevel of 'high' and riskState of 'atRisk' are specific properties populated by Microsoft Entra ID Protection (formerly Azure AD Identity Protection). These values indicate that the user account has been flagged as risky based on real-time risk detections (e.g., leaked credentials, anonymous IP address, atypical travel). This is not a direct result of a Sentinel analytics rule, nor does it mean the account is disabled or confirmed compromised—it means the identity protection service has detected suspicious activity and assigned a risk level.

Answer

The user account has been disabled

Answer

The user account triggered a Sentinel analytics rule

Answer

The user account has been confirmed compromised

Question 12

Refer to the exhibit. A SOC analyst runs this KQL query in Microsoft Sentinel. What is the purpose of this query?

Accepted Answer

Find users with more than 5 failed sign-ins from an IP address in the last hour. The KQL query filters for events where the result type is 'Failure' (failed sign-ins), then groups by account and IP address, counting occurrences. The `where count_ > 5` clause ensures only accounts with more than 5 failed sign-ins from a single IP are returned, which is a classic indicator of a brute force attack. This directly matches option D.

Answer

Detect brute force attempts by finding users with many failed sign-ins from a single IP

Answer

List all successful sign-ins in the last hour

Answer

Identify users who successfully signed in from multiple IPs

Question 13

Your organization uses Microsoft Sentinel for security operations. You need to ensure that a specific AWS CloudTrail log is ingested into Microsoft Sentinel. Which data connector should you use?

Accepted Answer

Amazon Web Services S3 Connector. The Amazon Web Services S3 Connector is the correct choice because AWS CloudTrail logs are stored as JSON files in an S3 bucket. Microsoft Sentinel ingests these logs by connecting directly to the S3 bucket, reading the CloudTrail log files, and pulling them into the Log Analytics workspace. The AWS CloudTrail Connector, by contrast, is a legacy connector that requires a separate AWS Lambda function and is deprecated in favor of the S3 connector.

Answer

AWS CloudTrail Connector

Answer

Azure Functions (AWS)

Answer

AWS Security Hub Connector

Question 14

Your security team receives alerts from Microsoft Defender for Cloud. You need to configure automated response to remediate a specific alert type. What should you create in Microsoft Sentinel?

Accepted Answer

An automation rule. In Microsoft Sentinel, automation rules are the correct mechanism to define automated responses triggered by alerts, including those from Microsoft Defender for Cloud. They allow you to run playbooks, change incident severity, assign ownership, or add comments when a specific alert type fires, enabling remediation without manual intervention.

Answer

An analytics rule

Answer

A workbook

Answer

A watchlist

Question 15

You are managing a Microsoft Sentinel workspace that ingests data from Microsoft 365 Defender. You notice that some incident creation rules are not generating incidents as expected. What should you check first?

Accepted Answer

The Microsoft 365 Defender data connector. The Microsoft 365 Defender data connector is the correct first check because it is the ingestion pipeline for security alerts from Microsoft 365 Defender into Microsoft Sentinel. If this connector is misconfigured, disconnected, or has stopped syncing, incident creation rules that depend on these alerts will not trigger, even if the analytics rules themselves are enabled and correctly configured.

Answer

The workspace daily usage cap

Answer

The SecurityIncident table schema

Answer

The analytics rule status