SC-200 Manage a security operations environment Practice Test 11 — 15 Questions

Question 1

A security analyst reports that a scheduled analytics rule in Microsoft Sentinel has stopped generating incidents after a recent update. The rule still runs but produces no alerts. What should you check first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Review the rule's query logic for changes or syntax errors.. The most likely cause of a scheduled analytics rule running but producing no alerts is a change or error in the KQL query logic. Since the rule still executes, the issue is not with the rule being disabled or paused, but rather with the query failing to return results due to syntax errors, schema changes, or logic flaws introduced during the update.

Answer

Verify that the rule is enabled and not paused.

Answer

Check the entity mapping configuration for missing fields.

Answer

Ensure that the automation rule triggering the incident is still active.

Question 2

Your Microsoft Sentinel workspace ingests logs from multiple sources but you notice that some custom logs are missing in the Log Analytics workspace. You've confirmed that the data connectors are healthy. What is the most likely cause?

Accepted Answer

The custom log table schema does not match the incoming log format.. When data connectors are healthy but custom logs are missing, the most common cause is a schema mismatch between the custom log table definition in the Log Analytics workspace and the actual log data being sent. Microsoft Sentinel requires the custom log table's schema (columns, data types, and delimiters) to exactly match the incoming log format; otherwise, the ingestion pipeline drops the records without error. This is because the Log Analytics agent or AMA uses the table schema to parse and transform the data, and any deviation results in silent failures.

Answer

There is a time gap between log generation and ingestion.

Answer

The workspace has exceeded its daily ingestion limit.

Answer

The data connectors are not properly configured for custom log ingestion.

Question 3

You are designing an automation rule in Microsoft Sentinel that should automatically assign incidents to the appropriate analyst based on the incident type. However, the rule fails to assign correctly for some incidents. What should you verify?

Accepted Answer

The order of conditions in the automation rule; ensure more specific conditions are evaluated first.. Automation rules in Microsoft Sentinel evaluate conditions in order, and the first matching condition triggers the associated action. If a broad condition (e.g., 'all incidents') is placed before a more specific condition (e.g., 'incident type equals Phishing'), the broad rule will match first and assign incorrectly, preventing the specific rule from ever running. Reordering conditions so that the most specific ones are evaluated first ensures correct assignment based on incident type.

Answer

That a playbook has been created to perform the assignment.

Answer

That the incident assignment rule in Microsoft Entra ID is configured correctly.

Answer

That the owner (analyst) has the required permissions in Microsoft Sentinel.

Question 4

Your organization is migrating from Azure Active Directory to Microsoft Entra ID. You need to ensure that Microsoft Sentinel continues to receive identity logs. What should you do?

Accepted Answer

No action is required; the existing connector automatically updates.. The migration from Azure Active Directory (Azure AD) to Microsoft Entra ID is a rebranding and consolidation effort that does not change the underlying service endpoints, APIs, or log schemas. The existing Azure AD data connector in Microsoft Sentinel continues to collect identity logs (e.g., Sign-in logs, Audit logs, Provisioning logs) without any reconfiguration because the connector is tied to the same underlying directory service. Therefore, no action is required; the existing connector automatically updates to reflect the new name.

Answer

Install the new Microsoft 365 Defender connector for identity logs.

Answer

Reconfigure the diagnostic settings to send logs to a new Log Analytics workspace.

Answer

Create a new data connector for Microsoft Entra ID.

Question 5

You have deployed Microsoft Defender for Endpoint and integrated it with Microsoft Sentinel. You notice that alerts from Defender for Endpoint are not appearing in Sentinel. What should you check first?

Accepted Answer

Verify that the Microsoft 365 Defender connector in Sentinel is enabled and configured.. The Microsoft 365 Defender connector in Microsoft Sentinel is the specific data connector responsible for ingesting alerts from Microsoft Defender for Endpoint (and other Defender products). If this connector is not enabled or misconfigured, alerts will not flow into Sentinel regardless of licensing, device onboarding, or analytics rules. This is the first and most direct check because the connector acts as the ingestion pipeline.

Answer

Confirm that Defender for Endpoint is licensed for all users.

Answer

Check that the alert severity is not being filtered out by analytics rules.

Answer

Ensure that all devices are onboarded to Defender for Endpoint.

Question 6

You are configuring an automated investigation and response (AIR) playbook in Microsoft Sentinel. The playbook should automatically block a user in Microsoft Entra ID when a high-severity incident is created. Which action should you include in the playbook?

Accepted Answer

Call the Microsoft Graph API to update the user's accountEnabled property to false.. The 'Block user' action is not available in the Microsoft Entra ID connector for Azure Logic Apps; instead, you must call the Microsoft Graph API to update the user's `accountEnabled` property to `false`. This directly disables the user account in Microsoft Entra ID, effectively blocking their access. The playbook in Microsoft Sentinel uses Azure Logic Apps, and the Graph API is the appropriate method to perform this action programmatically.

Answer

Use the 'Block user' action from the Microsoft Entra ID connector in Azure Logic Apps.

Answer

Add a 'Block IP' action from the Azure Firewall connector.

Answer

Add a 'Change incident status' action to close the incident.

Question 7

Which TWO actions can reduce the cost of Microsoft Sentinel while maintaining security coverage?

Accepted Answer

Configure some tables to use Basic Logs tier.. Configuring tables to use the Basic Logs tier reduces ingestion costs for high-volume, verbose logs (e.g., from firewalls or DNS servers) while still retaining the data for security analysis. Basic Logs are stored at a lower cost per GB but have reduced query capabilities (e.g., no interactive full-text search, limited to KQL summarization). This allows you to keep security coverage by retaining the logs for detection and investigation, albeit with a different query pattern.

Answer

Remove unused data connectors.

Answer

Switch to a pay-as-you-go workspace.

Answer

Reduce workspace retention to 30 days for all tables.

Question 8

Which THREE components are required to use Microsoft Sentinel's automation rules to automatically respond to incidents?

Accepted Answer

The appropriate permissions to run playbooks.. Automation rules require appropriate permissions (e.g., Microsoft Sentinel Contributor or Automation Contributor) to execute playbooks. Without these permissions, the automation rule cannot invoke the playbook when an incident is created or updated, even if the rule and playbook are properly configured.

Answer

A playbook created in Azure Logic Apps.

Answer

An analytics rule generating alerts.

Question 9

Which TWO Microsoft Sentinel features allow you to organize and prioritize incidents for better triage?

Accepted Answer

Incident assignment to analysts.. Incident assignment allows security operations center (SOC) analysts to take ownership of specific incidents, ensuring accountability and preventing duplicate work. This feature directly supports triage by routing incidents to the appropriate team member based on skills or workload. Option E is correct because classification and tagging let analysts categorize incidents by severity, attack type, or status, enabling efficient filtering and prioritization across the incident queue.

Answer

Entity mapping in analytics rules.

Answer

Automation rules with incident creation triggers.

Answer

Workbooks for dashboard reporting.

Question 10

Your security team receives frequent false positive alerts from Microsoft Defender for Cloud Apps. You need to reduce noise without disabling any threat detection policies. What should you do?

Accepted Answer

Configure suppression rules based on user, IP, or app to automatically dismiss matching alerts.. Suppression rules in Microsoft Defender for Cloud Apps allow you to automatically dismiss alerts that match specific criteria (e.g., user, IP address, or app) without disabling the underlying threat detection policy. This reduces false positive noise while keeping the detection engine active for genuine threats. Disabling policies or adjusting severity thresholds would either remove detection entirely or fail to address the root cause of false positives.

Answer

Disable the built-in anomaly detection policies that generate false positives.

Answer

Adjust the alert severity thresholds in the policy settings.

Answer

Create custom detection policies to override default rules.

Question 11

You are managing a Microsoft Sentinel environment. You need to ensure that incidents are automatically assigned to the appropriate analyst based on the type of attack. The assignment must consider the current workload of each analyst. What should you use?

Accepted Answer

Use an automation rule with a playbook that queries the current incident assignments and assigns to the least busy analyst.. Automation rules in Microsoft Sentinel can trigger a playbook (Azure Logic App) that queries the current incident assignments and assigns the incident to the analyst with the fewest active incidents. This satisfies both the attack-type mapping (via the analytics rule that generates the incident) and the workload-balancing requirement, as the playbook can dynamically evaluate workload using Azure Resource Graph or Sentinel's API.

Answer

Configure multiple analytics rules, each with a different incident owner.

Answer

Create a watchlist that maps attack types to analyst names and use it in an analytics rule.

Answer

Create a workbook that shows analyst workload and manually assign.

Question 12

Your organization uses Microsoft Defender XDR. You need to ensure that all cloud app alerts are forwarded to Microsoft Sentinel for correlation. What should you configure?

Accepted Answer

In Microsoft Sentinel, enable the data connector for Microsoft Defender for Cloud Apps.. The Microsoft Defender for Cloud Apps data connector in Microsoft Sentinel is specifically designed to ingest alerts and cloud discovery logs from Defender for Cloud Apps. Enabling this connector ensures that all cloud app alerts are automatically forwarded to Sentinel for correlation without requiring custom API queries or external export pipelines.

Answer

Create an analytics rule in Sentinel that queries Defender for Cloud Apps API.

Answer

Configure Microsoft Defender for Cloud Apps to export alerts to Azure Event Hubs.

Answer

In Microsoft Sentinel, enable the data connector for Microsoft Defender for Endpoint.

Question 13

You are responsible for Microsoft Defender for Identity. The security team reports that some high-confidence alerts are not triggering any automated response. You need to automate the response for these alerts. What should you configure?

Accepted Answer

In Microsoft Defender XDR, configure automated investigation and response for Identity alerts.. Microsoft Defender for Identity alerts are natively integrated into Microsoft Defender XDR (formerly Microsoft 365 Defender), which provides automated investigation and response (AIR) capabilities. By configuring AIR for Identity alerts in Defender XDR, you can automatically trigger remediation actions such as suspending compromised accounts or blocking suspicious activities without additional scripting or third-party tools.

Answer

Use Microsoft Intune to trigger a script on domain controllers when an alert fires.

Answer

Create an automation rule in Microsoft Sentinel to respond to Identity alerts.

Answer

Configure Microsoft Purview compliance policies to respond to Identity alerts.

Question 14

Your Microsoft Sentinel workspace has multiple analytics rules generating incidents. You need to automatically group related incidents from different rules into a single incident to reduce analyst workload. The grouping should occur within 30 minutes of the first incident creation. What should you do?

Accepted Answer

Create an incident creation rule that groups alerts from multiple analytics rules based on entity matching.. Incident creation rules in Microsoft Sentinel can aggregate alerts from multiple analytics rules into a single incident based on entity matching and a time window. This meets the requirement to group related incidents from different rules within 30 minutes. Option B is incorrect because incident grouping in analytics rule settings only groups alerts within the same rule, not across different rules. Option A could work with a custom playbook but is more complex and not the native solution. Option D is manual and does not automate the grouping.

Answer

Use an automation rule with a playbook that queries for related incidents and merges them.

Answer

Configure incident grouping in the analytics rule settings with a matching condition and a 30-minute time window.

Answer

Create a workbook to display related incidents and manually merge them.

Question 15

Your organization uses Microsoft Defender for Office 365. You need to ensure that when a user reports a phishing email, the email is automatically analyzed and remediated. What should you configure?

Accepted Answer

Configure User Reported Message settings to use the built-in reporting tool and automated investigation.. The User Reported Message settings in Defender for Office 365 allow you to configure what happens when users report messages, including automated investigation and remediation. Option B is incorrect because Anti-Phish policies detect and handle phishing emails but do not directly process user-reported messages for automated investigation. Option C is incorrect because Safe Attachments policy scans attachments for malicious content but does not handle user-reported message remediation. Option D is incorrect because Safe Links policy protects against malicious URLs but does not automatically analyze user-reported emails.

Answer

Configure Anti-Phish policy to move messages to quarantine.

Answer

Enable Safe Attachments policy.

Answer

Enable Safe Links policy.