SC-200 Manage a security operations environment Practice Test 11 — 15 Questions

Question 1

You need to grant a junior analyst the ability to view and investigate incidents in Microsoft Sentinel, but not make any changes. Which built-in role should you assign?

Accepted Answer

Microsoft Sentinel Reader. The Microsoft Sentinel Reader role provides read-only access to Sentinel resources, including incidents, workbooks, and analytics rules, without allowing any modifications. This aligns with the requirement to view and investigate incidents without making changes, as the role explicitly denies write, delete, or action permissions on Sentinel data.

Answer

Microsoft Sentinel Responder

Answer

Microsoft Sentinel Contributor

Answer

Microsoft Sentinel Automation Contributor

Question 2

Your organization uses Microsoft Defender for Endpoint. You need to configure a device group that automatically assigns devices to the group based on their domain membership. Devices joined to 'contoso.com' should be in the 'Corporate' group, and all others in 'Non-Corporate'. What should you use?

Accepted Answer

Create a device group with a rule using the device tag 'Contoso' and assign tags via GPO.. Microsoft Defender for Endpoint device groups can use device tags to automatically assign devices based on domain membership. By creating a device group with a rule that matches the device tag 'Contoso' and assigning that tag to domain-joined machines via Group Policy Object (GPO), you ensure that devices joined to 'contoso.com' are placed in the 'Corporate' group, while all others fall into the default 'Non-Corporate' group.

Answer

Use a custom detection rule to move devices based on risk level.

Answer

Create two device groups and manually move devices.

Answer

Create a device group with a rule using the domain field 'contoso.com'.

Question 3

You need to ensure that Microsoft Sentinel can access threat intelligence feeds from external sources like AlienVault OTX. Which data connector should you use?

Accepted Answer

Threat Intelligence - TAXII data connector. The Threat Intelligence - TAXII data connector is the correct choice because it enables Microsoft Sentinel to ingest threat intelligence feeds from external sources that support the TAXII (Trusted Automated eXchange of Indicator Information) protocol, such as AlienVault OTX. This connector uses the STIX (Structured Threat Information Expression) standard to pull indicators of compromise (IOCs) like IP addresses, domains, and hashes directly into Sentinel for correlation and alerting.

Answer

Microsoft 365 Defender data connector

Answer

Microsoft Entra ID data connector

Answer

Amazon Web Services data connector

Question 4

Which TWO of the following are valid ways to automate incident response in Microsoft Sentinel?

Accepted Answer

Create a playbook using Azure Logic Apps.. Azure Logic Apps is the native workflow engine for Microsoft Sentinel playbooks, allowing security analysts to automate incident response actions such as blocking IPs, resetting passwords, or enriching alerts. Playbooks are triggered by automation rules or directly from incidents, and they leverage hundreds of connectors to integrate with external systems. This is the primary and recommended method for building automated response workflows in Sentinel.

Answer

Use Azure Functions to run a script.

Answer

Use PowerShell to modify incidents via API.

Answer

Use Microsoft Power Automate to create a flow.

Question 5

Which TWO of the following are required to enable user and entity behavior analytics (UEBA) in Microsoft Sentinel?

Accepted Answer

Windows Security Events via AMA must be ingested.. Windows Security Events ingested via the Azure Monitor Agent (AMA) provide the necessary user and entity activity data (e.g., logon events, process creation) that UEBA analyzes to establish behavioral baselines and detect anomalies. Without this data source, UEBA lacks the raw security events required for user and entity profiling.

Answer

Microsoft Entra ID diagnostic logs must be streamed.

Answer

Azure subscription diagnostic logs must be enabled.

Answer

Microsoft Defender XDR connector must be configured.

Question 6

Your security operations team receives an alert from Microsoft Sentinel about a suspicious sign-in from an unfamiliar IP address. You need to investigate the alert by correlating it with user activity and device information. Which data sources should you query first?

Accepted Answer

Microsoft Entra ID sign-in logs and Microsoft Defender for Endpoint device events. Investigating a suspicious sign-in requires correlating the sign-in event with user activity and device context. Microsoft Entra ID sign-in logs provide the authentication details (IP address, timestamp, user), while Microsoft Defender for Endpoint device events supply device-level telemetry (processes, network connections, logged-on users). This combination directly enables the correlation needed to validate whether the sign-in was legitimate or malicious.

Answer

Microsoft Purview audit logs and Microsoft Intune device compliance

Answer

Microsoft 365 Defender alerts and Microsoft Sentinel incidents

Answer

Azure Activity Logs and Azure Firewall logs

Question 7

You are configuring Microsoft Sentinel to detect potential ransomware activity. The security team wants to be alerted when a single host contacts multiple suspicious domains within a short time. Which analytic rule type should you create?

Accepted Answer

NRT (Near-Real-Time) rule. A NRT (Near-Real-Time) rule is the correct choice because it continuously processes events with a minimum latency of about 1 minute, making it ideal for detecting patterns like a single host contacting multiple suspicious domains within a short time window. Unlike scheduled rules that run on a fixed interval (e.g., every 5 minutes), NRT rules evaluate data as it arrives, enabling rapid detection of multi-event sequences such as DNS queries to known malicious domains.

Answer

Scheduled query rule

Answer

Anomaly rule

Answer

Microsoft security rule

Question 8

Your organization uses Microsoft Defender XDR and Microsoft Sentinel. You need to create a custom detection rule that triggers when a user is added to a privileged role in Microsoft Entra ID and within 5 minutes performs a mass download from SharePoint. Which approach should you use?

Accepted Answer

Create a scheduled query rule in Microsoft Sentinel. The detection requires correlating events across Microsoft Entra ID (privileged role assignment) and SharePoint (mass download) within a 5-minute window. Microsoft Sentinel's scheduled query rules can ingest data from multiple sources (e.g., AuditLogs for Entra ID and SharePoint via Office 365 connector) and use KQL to join these events with a time constraint, making it the only native solution for cross-domain, time-bound custom detections.

Answer

Create an advanced hunting query in Microsoft Defender XDR

Answer

Use a custom detection rule in Microsoft 365 Defender

Answer

Use a Microsoft Purview insider risk policy

Question 9

Your security team uses Microsoft Sentinel automation rules to respond to incidents. You need to ensure that critical incidents are automatically assigned to a senior analyst in the Americas time zone and that a Teams message is sent to a specific channel. Which configuration should you use?

Accepted Answer

Create a playbook that assigns the incident and sends a Teams message, then attach it to a automation rule. Automation rules in Microsoft Sentinel can trigger a playbook when an incident is created or updated. By creating a playbook that assigns the incident to a specific senior analyst (using Microsoft Entra ID or a watchlist for mapping) and sends a Teams message via the Teams connector, then attaching that playbook to an automation rule with conditions for critical severity, you meet both requirements. This approach leverages native Sentinel automation without custom connectors or manual email triggers.

Answer

Use a watchlist to map critical incidents to senior analysts and trigger an email

Answer

Configure the analytics rule to set the incident owner and add a playbook action

Answer

Create a custom connector in Power Automate to monitor Sentinel incidents

Question 10

You are a security operations analyst. You need to review all incidents from the past 24 hours that have a high severity and involve multiple users. In Microsoft Sentinel, which blade should you use?

Accepted Answer

Incidents. The Incidents blade in Microsoft Sentinel is the correct place to review all security incidents, including filtering by severity and the number of users involved. It provides a centralized view where you can apply filters for 'High' severity and 'Multiple users' to meet the requirement of reviewing incidents from the past 24 hours. The Hunting, Workbooks, and Analytics blades serve different purposes and do not offer the same incident review and filtering capabilities.

Answer

Hunting

Answer

Workbooks

Answer

Analytics

Question 11

Your organization uses Microsoft Sentinel in a multi-workspace environment with a central SOC. You need to create a single incident view across all workspaces while minimizing latency. What should you deploy?

Accepted Answer

Enable incident across workspaces in Microsoft Sentinel. Microsoft Sentinel's 'Incident across workspaces' feature (enabled via the 'SecurityIncident' table union) provides a single incident view across multiple workspaces with minimal latency by leveraging built-in cross-workspace incident synchronization. This avoids the overhead of manual queries or external orchestration, ensuring near-real-time incident correlation for a central SOC.

Answer

Use cross-workspace queries in a workbook

Answer

Merge all workspaces into one Log Analytics workspace

Answer

Set up Azure Lighthouse and connect workspaces

Question 12

Your Microsoft Sentinel environment is not generating incidents from a custom KQL detection rule. The rule runs successfully in the Log Analytics query editor but no incidents appear. What is the most likely cause?

Accepted Answer

The rule is set to create alerts but not incidents. The most likely cause is that the rule is set to create alerts but not incidents. In Microsoft Sentinel, analytics rules have a toggle to 'Create incidents' from alerts. If this toggle is disabled, alerts are generated but not grouped into incidents. The query running successfully in Log Analytics confirms the rule logic works, but incidents will not appear unless the incident creation toggle is enabled. Entity mapping is not required for incident creation; it enhances correlation but is not a prerequisite.

Answer

The rule's alert grouping settings are misconfigured

Answer

The rule's query schedule is too long

Answer

The rule does not have entity mapping configured

Question 13

As a SOC analyst, you need to quickly identify if a specific user account has been involved in any incidents in the past week. Which feature in Microsoft Sentinel allows you to search for user-related incidents?

Accepted Answer

Entity behavior blade. The Entity behavior blade in Microsoft Sentinel provides a user-centric view that aggregates all incidents, alerts, and activities associated with a specific user account. By selecting a user entity and navigating to the 'Incidents' tab within the blade, you can quickly filter incidents involving that user over a defined time range, such as the past week. This feature is designed specifically for investigating user-related security events without needing to write custom queries.

Answer

Incidents blade with time range filter

Answer

Hunting blade with user query

Answer

Workbooks with KQL query

Question 14

Your security operations center uses Microsoft Sentinel and Microsoft Defender XDR. A new type of attack involves a user receiving a malicious email that triggers a macro, which then executes PowerShell to download a payload. You need to create a detection that correlates email, process creation, and network connection events from multiple Microsoft 365 Defender sources. What should you use?

Accepted Answer

Advanced hunting in Microsoft 365 Defender. Advanced hunting in Microsoft 365 Defender is the correct choice because it allows you to write Kusto Query Language (KQL) queries that can join data across multiple tables from different Microsoft 365 Defender sources, such as EmailEvents, DeviceProcessEvents, and DeviceNetworkEvents. This enables correlation of the email receipt, macro-triggered PowerShell process creation, and subsequent network connection to a malicious IP or domain in a single query, which is exactly what the scenario requires.

Answer

Scheduled query rule in Microsoft Sentinel

Answer

Custom detection rule in Microsoft 365 Defender

Answer

Fusion rule in Microsoft Sentinel

Question 15

Which TWO actions should you take to improve the performance of Microsoft Sentinel analytics rules that are running slowly? (Choose two.)

Accepted Answer

Reduce the query time window. Reducing the query time window (Option B) directly limits the volume of data the analytics rule must process per execution, which reduces query latency and overall rule execution time. This is a common performance optimization because Sentinel analytics rules run KQL queries against the Log Analytics workspace, and smaller time ranges mean fewer log records to scan.

Answer

Assign a higher severity to the rule

Answer

Increase the rule run frequency

Answer

Add additional entity mapping