SC-200 Manage a security operations environment Practice Test 12 — 15 Questions

Question 1

You are the security analyst for a company that uses Microsoft Sentinel. You notice that a critical analytics rule has not generated any incidents in the past week, but you know that relevant logs are being ingested. You need to troubleshoot why the rule is not firing. What is the first step you should take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Run the analytics rule's query directly in Log Analytics to see if it returns results.. The first step in troubleshooting a Sentinel analytics rule that is not generating incidents despite relevant logs being ingested is to run the rule's query directly in Log Analytics. This isolates whether the issue is with the query logic itself (e.g., syntax errors, time range misconfiguration, or data not matching the KQL conditions) rather than with data ingestion or rule settings. If the query returns results in Log Analytics, the problem lies elsewhere; if it returns no results, the query needs adjustment.

Answer

Check the incident creation rule configuration.

Answer

Verify that the log sources are connected and sending data to the workspace.

Answer

Disable and re-enable the analytics rule.

Question 2

Your company uses Microsoft Defender XDR. The security team needs to restrict access to the Microsoft Defender portal so that only analysts in the 'Security Operations' group can view incidents. What is the most efficient way to achieve this?

Accepted Answer

Create a custom role in the Microsoft Defender portal with permissions to view incidents and assign it to the Security Operations group.. Microsoft Defender XDR uses role-based access control (RBAC) within the portal itself. Creating a custom role with permissions to view incidents and assigning it to the Security Operations group directly controls access to incident data without affecting broader Azure AD roles or requiring Conditional Access policies. This is the most efficient method as it scopes permissions precisely to the Defender portal's incident management functionality.

Answer

Assign the Security Operations group the Defender for Endpoint administrator role.

Answer

Configure Conditional Access policy to allow only Security Operations group to sign in to the Defender portal.

Answer

Assign the Security Operations group the Security Reader role in Microsoft Entra ID.

Question 3

You manage Microsoft Sentinel. You need to ensure that an automated response is triggered when a specific type of incident is created. The response should send an email to the on-call security engineer. What should you use?

Accepted Answer

Create an automation rule that runs a playbook when an incident is created.. Automation rules in Microsoft Sentinel can trigger a playbook (an Azure Logic Apps workflow) when an incident is created. The playbook can include an action to send an email to the on-call security engineer, providing the automated response required by the scenario.

Answer

Use a watchlist to map incident types to email addresses and configure a scheduled query.

Answer

Modify the analytics rule to include an email action in the rule settings.

Answer

Create a workbook that alerts via email when new incidents appear.

Question 4

Which TWO actions should you take to improve the performance of Microsoft Sentinel analytics rules that query large datasets?

Accepted Answer

Use a time filter in the query to limit the data range.. Applying a time filter (e.g., using the `TimeGenerated` column) in a KQL query restricts the dataset to only the relevant time window, which significantly reduces the amount of data scanned by Microsoft Sentinel. This directly improves query performance by minimizing I/O and processing overhead, especially when analytics rules run against large log tables.

Answer

Use a watchlist to pre-filter results.

Answer

Change the data type of the columns to string.

Answer

Simplify the event by removing unused columns using project.

Question 5

Which THREE components are required to enable automated investigation and response (AIR) in Microsoft Defender XDR for alerts from Microsoft Defender for Identity?

Accepted Answer

Automated investigation and response enabled in Microsoft Defender XDR.. Automated investigation and response (AIR) must be explicitly enabled in Microsoft Defender XDR to allow the platform to automatically respond to alerts. Without this setting enabled, even if other components are in place, the system will not trigger automated actions for Defender for Identity alerts.

Answer

Microsoft Sentinel workspace configured to ingest Defender for Identity alerts.

Answer

A custom playbook in Microsoft Sentinel.

Question 6

Which TWO tasks can you perform using Microsoft Sentinel automation rules?

Accepted Answer

Assign an incident to an analyst.. Automation rules in Microsoft Sentinel can directly assign incidents to specific analysts or groups without requiring a playbook. This is a native action within the automation rule configuration, enabling immediate ownership and accountability for incident response.

Answer

Send an email notification without a playbook.

Answer

Delete an incident.

Answer

Create a new analytics rule.

Question 7

Refer to the exhibit. You have a Logic Apps playbook that triggers on Microsoft Sentinel alerts. The playbook is not posting messages to Teams. What is the most likely cause?

Accepted Answer

The playbook is using the wrong trigger type.. The playbook is triggered on Microsoft Sentinel alerts, but Logic Apps requires a specific trigger type to process these alerts correctly. The most likely cause is that the playbook uses a generic HTTP trigger instead of the 'Microsoft Sentinel Incident' or 'Microsoft Sentinel Alert' trigger, which is designed to parse the alert payload and provide the necessary context for downstream actions like posting to Teams. Without the correct trigger, the playbook may not receive the alert data or may fail to execute the Teams connector properly.

Answer

The Teams connector is not authenticated.

Answer

The trigger body is not referencing the correct alert ID.

Answer

The JSON syntax is invalid.

Question 8

Refer to the exhibit. You have a KQL query in a Microsoft Sentinel analytics rule. The rule is not generating incidents even though there are 'Suspicious sign-in' alerts from non-contoso.com users. What is the most likely issue?

Accepted Answer

The query is querying the wrong table. 'Suspicious sign-in' alerts may be in a different table.. The query is likely querying the 'Alert' table, but 'Suspicious sign-in' alerts from non-contoso.com users are generated by Microsoft Defender for Identity or Azure AD Identity Protection and stored in the 'SecurityAlert' table (or 'AlertEvidence' in the new schema). The rule's query must reference the correct table to retrieve these alerts; otherwise, no matching records are found, and no incidents are created.

Answer

The 'extend' line is incorrectly parsing the entity.

Answer

The 'where' clause using !endswith is incorrect.

Answer

The query does not filter by AlertName correctly.

Question 9

Refer to the exhibit. You deploy this ARM template to deploy a saved search in a Microsoft Sentinel workspace. After deployment, the saved search does not appear in Sentinel. What is the most likely reason?

Accepted Answer

The apiVersion is outdated for saved searches in Sentinel.. The apiVersion specified in the ARM template is outdated for saved searches in Microsoft Sentinel. Saved searches require a specific apiVersion (e.g., '2021-04-01' or later) that supports the 'Microsoft.OperationalInsights/workspaces/savedSearches' resource type. An outdated apiVersion can cause the deployment to fail silently or not register the saved search in Sentinel, even if the template syntax is otherwise valid.

Answer

The query syntax is invalid.

Answer

The resource type is incorrect.

Answer

The name parameter is incorrectly formatted.

Question 10

Your organization uses Microsoft Sentinel. You need to ensure that incident investigation is efficient by automatically grouping related alerts into incidents. Which configuration should you use?

Accepted Answer

Configure alert grouping in the analytics rule wizard. Microsoft Sentinel's analytics rule wizard includes a dedicated 'Alert grouping' configuration that allows you to specify how alerts from the same analytics rule are automatically combined into a single incident. This setting is essential for efficient incident investigation, as it reduces alert noise by grouping related alerts based on criteria such as matching entities, time windows, or custom alert details, ensuring that security analysts work with consolidated incidents rather than individual alerts.

Answer

Create an automation rule to group alerts

Answer

Use a playbook to merge incidents

Answer

Define a watchlist to consolidate alerts

Question 11

Your security team uses Microsoft Defender XDR. You need to ensure that a user who is suspected of credential theft is immediately blocked from accessing corporate email and cloud apps, while the investigation continues. What should you do?

Accepted Answer

Use Microsoft Defender for Cloud Apps to suspend the user. Suspending the user in Microsoft Defender for Cloud Apps immediately revokes the user's access tokens and active sessions for cloud apps, blocking further access to corporate email and cloud apps without deleting the account. This allows the investigation to continue while the user is isolated, which is the precise requirement for a suspected credential theft scenario.

Answer

Create a conditional access policy in Microsoft Entra ID to block the user

Answer

Disable the user account in Microsoft Entra ID

Answer

Reset the user's password from Microsoft Entra ID

Question 12

You manage a Microsoft Sentinel workspace that ingests logs from multiple sources. You notice that the workspace is approaching its daily ingestion quota, and some data sources are being dropped. You need to ensure that security-related logs are prioritized and that non-critical logs are not ingested. What should you configure?

Accepted Answer

Use data collection rules (DCRs) to filter log ingestion. Data collection rules (DCRs) allow you to define transformations that filter logs before they are ingested into a Log Analytics workspace. By configuring a DCR with a KQL-based transformation, you can drop non-critical logs while ensuring security-related logs are always ingested, preventing them from being dropped when the daily quota is approached.

Answer

Create analytic rules with entity mapping to prioritize alerts

Answer

Set a daily cap on the Log Analytics workspace

Answer

Configure diagnostic settings to exclude certain logs

Question 13

Your incident response team uses Microsoft Sentinel. You need to automatically assign incidents to the appropriate analyst based on the type of alert. What should you create?

Accepted Answer

An automation rule with an 'Assign owner' action. Automation rules in Microsoft Sentinel allow you to define conditions (e.g., alert type) and corresponding actions, including 'Assign owner' to automatically route incidents to the appropriate analyst. This is the native, no-code mechanism for incident assignment based on alert properties, making it the correct choice for this requirement.

Answer

A playbook that runs when an incident is created

Answer

A watchlist containing analyst names

Answer

A hunting bookmark to track assignments

Question 14

Your company uses Microsoft Defender for Cloud Apps. You discover that a user is accessing sensitive data from an unfamiliar IP address. You need to immediately block the user's access to all cloud apps while preserving the session for investigation. What should you do?

Accepted Answer

Use the 'Block' governance action in Defender for Cloud Apps. The 'Block' governance action in Defender for Cloud Apps immediately blocks the user's access to all cloud apps while preserving the session for investigation. This action is applied directly within the Defender for Cloud Apps portal, allowing you to stop data exfiltration without disrupting the ability to analyze the session logs or alerts. It is the only option that meets the requirement of blocking access while keeping the session intact for forensic review.

Answer

Create a conditional access policy to block the IP

Answer

Add the IP to the blocked IP address range list

Answer

Suspend the user from Microsoft Entra ID

Question 15

You are configuring Microsoft Sentinel automation rules to handle incidents from multiple analytics rules. You need to ensure that incidents from a specific rule are automatically assigned to the 'SOC Tier 2' group and have a severity of 'High' regardless of the original severity. What should you do?

Accepted Answer

Configure an automation rule with 'Add tag' and 'Set severity' actions, plus 'Assign owner'. Automation rules in Microsoft Sentinel can directly modify incident properties such as severity and owner without requiring external logic apps or playbooks. Option D correctly uses the 'Set severity' action to override the original severity to 'High' and the 'Assign owner' action to assign the incident to the 'SOC Tier 2' group, fulfilling both requirements in a single, efficient rule.

Answer

Use a logic app trigger to change severity

Answer

Create a playbook to modify the incident properties

Answer

Create a separate analytics rule to override the incident