SC-200 Manage a security operations environment Practice Test 12 — 15 Questions

Question 1

Which THREE components are required to enable automation in Microsoft Sentinel? (Choose three.)

Accepted Answer

Playbooks based on Azure Logic Apps. Playbooks based on Azure Logic Apps are required because they provide the workflow automation engine that executes response actions in Microsoft Sentinel. Without a Logic Apps resource to define the steps (e.g., triggers, conditions, and actions), there is no executable automation to run when an incident or alert is generated.

Answer

Microsoft Power Automate license

Answer

Microsoft Entra ID P2 license

Question 2

Which TWO data sources are natively supported by Microsoft Sentinel for ingesting security events? (Choose two.)

Accepted Answer

Windows Security Events. Windows Security Events are natively supported by Microsoft Sentinel via the Windows Security Events via AMA connector or the legacy Log Analytics agent. This connector ingests security event logs (e.g., Event ID 4625 for failed logons) directly into Sentinel without requiring a third-party parser or custom data connector. Azure Activity Logs are also natively supported through the Azure Activity connector, which streams subscription-level operational events (e.g., resource creation, policy changes) into Sentinel at no additional cost.

Answer

Salesforce audit logs

Answer

GitHub audit logs

Answer

Google Cloud Platform (GCP) logs

Question 3

Your organization uses Microsoft Sentinel with a Log Analytics workspace in the East US region. You need to ensure that incident investigation data is retained for two years for compliance. What should you configure?

Accepted Answer

Adjust the Interactive retention period to 730 days in the Log Analytics workspace.. Log Analytics workspaces allow you to configure the Interactive retention period independently from the Total retention period. Setting Interactive retention to 730 days ensures that incident investigation data remains available for interactive queries for the full two-year compliance requirement, without needing to enable archive or change log types.

Answer

Configure a data retention policy in Microsoft Purview.

Answer

Set the Total retention period to 730 days and enable Archive.

Answer

Enable Basic Logs and set retention to 730 days.

Question 4

Your company deploys Microsoft Sentinel in a multi-workspace environment. You need to centralize incident management across workspaces while maintaining data residency. You configure Sentinel workspaces in each region. What additional configuration is required to view all incidents from a single pane?

Accepted Answer

Use an incident manager with a cross-workspace view.. Microsoft Sentinel supports cross-workspace incident management through the incident manager, which can be configured to display incidents from multiple workspaces in a single view. This is achieved by using the 'cross-workspace view' feature, which leverages Azure Resource Graph to query incidents across workspaces without moving data, thus maintaining data residency requirements.

Answer

Deploy the Microsoft Sentinel solution across workspaces.

Answer

Assign the same Azure RBAC roles to all users in each workspace.

Answer

Merge the workspaces into a single workspace.

Question 5

Your organization has Microsoft Defender for Cloud Apps enabled. You need to generate an alert when a user downloads more than 100 files from SharePoint in one hour. What should you create?

Accepted Answer

An anomaly detection policy in Microsoft Defender for Cloud Apps.. An anomaly detection policy in Microsoft Defender for Cloud Apps is designed to detect unusual user behavior, such as mass file downloads, by establishing a baseline and triggering alerts when activity deviates from the norm. This policy type specifically supports the scenario of detecting a user downloading more than 100 files from SharePoint in one hour, as it can be configured with custom thresholds for file download activity.

Answer

A data loss prevention (DLP) policy in Microsoft Purview.

Answer

A custom alert in Microsoft Sentinel using the CloudAppEvents table.

Answer

An app governance policy in Microsoft Defender for Cloud Apps.

Question 6

Your incident response team uses Microsoft Sentinel. You need to automatically assign incidents to the appropriate analyst based on the incident category. What should you configure?

Accepted Answer

Create an automation rule that runs a playbook to assign the incident.. Automation rules in Microsoft Sentinel can trigger a playbook when an incident is created or updated. By configuring an automation rule with a condition based on the incident category, you can invoke a playbook that uses the Microsoft Sentinel API or Logic Apps to set the incident's owner field, thereby assigning it to the appropriate analyst. This is the correct approach because automation rules are designed to run automated responses, including playbooks, on incidents.

Answer

Create an analytics rule that sets the owner field.

Answer

Create a custom incident label for each category.

Answer

Create a workbook that filters incidents by category.

Question 7

Your SOC uses Microsoft Sentinel and Microsoft Defender XDR. You need to ensure that all incidents from Defender XDR are automatically synchronized to Sentinel. You have enabled the Defender XDR connector. However, some incidents are not appearing. What should you check first?

Accepted Answer

Check the connector's data filter settings for severity or status.. The Defender XDR connector in Microsoft Sentinel allows filtering of incidents based on severity and status during configuration. If incidents are not appearing, the most common cause is that the connector's data filter settings are excluding them—for example, filtering out 'Informational' severity or 'Resolved' status incidents. This is the first thing to check because the connector is enabled and working, but the filter is preventing synchronization of certain incidents.

Answer

Confirm that the incident is displayed in a Sentinel workbook.

Answer

Ensure that alert grouping is enabled in Sentinel.

Answer

Verify that the Microsoft Defender XDR license is active.

Question 8

Your organization uses Microsoft Purview Data Loss Prevention (DLP). You need to receive an alert when a user attempts to share a credit card number via email. What should you configure?

Accepted Answer

Create a DLP policy in Microsoft Purview with the credit card number sensitive info type.. Microsoft Purview DLP policies can be configured to detect sensitive information types, such as credit card numbers, and trigger alerts when users attempt to share that data via email. By creating a DLP policy with the credit card number sensitive info type and setting an action to send an alert, you meet the requirement to receive an alert on such sharing attempts.

Answer

Create a sensitivity label that blocks sharing.

Answer

Create a retention label that identifies credit card data.

Answer

Create a file policy in Microsoft Defender for Cloud Apps.

Question 9

Your SOC is investigating an incident in Microsoft Sentinel. You need to quickly identify all related alerts and entities across the timeline. What Microsoft Sentinel feature should you use?

Accepted Answer

Open the incident investigation graph.. The incident investigation graph in Microsoft Sentinel provides a visual, interactive map of all alerts, entities (such as users, IP addresses, hosts), and their relationships linked to a specific incident. This allows SOC analysts to quickly see the full scope of an incident across the timeline without manually correlating data, making it the correct tool for this scenario.

Answer

Run a hunting query.

Answer

Review the analytics rule that generated the incident.

Answer

Use the Incident workbook.

Question 10

Your organization has Microsoft Sentinel with UEBA enabled. An incident is generated for a user with high risk score. You need to identify if the user's recent behavior deviates from their baseline. Which Sentinel feature should you use?

Accepted Answer

The UEBA timeline in the entity page.. The UEBA timeline in the entity page is the correct feature because it provides a chronological view of a user's activities, including deviations from their established behavioral baseline. When UEBA is enabled, Sentinel profiles normal behavior for each user and flags anomalies; the timeline directly visualizes these deviations, such as unusual login times, locations, or resource access, which aligns with the need to identify if recent behavior deviates from the baseline.

Answer

A custom hunting query using the BehaviorAnalytics table.

Answer

The user's Azure AD sign-in logs.

Answer

The incident investigation graph.

Question 11

Which TWO actions should you take to optimize cost in Microsoft Sentinel while maintaining security coverage? (Choose two.)

Accepted Answer

Adjust the interactive retention period for tables that don't need long-term interactive access.. Reducing interactive retention for tables that do not require long-term, fast query access directly lowers storage costs. Microsoft Sentinel charges per GB for data stored in the interactive retention tier, while data moved to long-term retention (up to 12 years) is significantly cheaper. By tailoring retention periods to actual operational needs, you avoid paying premium rates for data that is rarely queried interactively.

Answer

Enable continuous export for all tables.

Answer

Purchase a Pay-as-you-go commitment tier.

Answer

Add more tables to ingest data.

Question 12

Which TWO data connectors can be used to ingest Microsoft 365 audit logs into Microsoft Sentinel? (Choose two.)

Accepted Answer

Microsoft 365 Defender connector.. The Microsoft 365 Defender connector (Option B) ingests unified audit logs from Microsoft 365 Defender, which includes security-related events from Microsoft 365 services. The Office 365 connector (Option C) directly ingests audit logs from Exchange Online, SharePoint Online, and Microsoft Teams, which are part of the Microsoft 365 audit log. Both connectors are designed to bring Microsoft 365 audit log data into Microsoft Sentinel.

Answer

Microsoft Defender for Cloud Apps connector.

Answer

Azure Activity connector.

Answer

Azure AD connector (sign-in logs).

Question 13

Refer to the exhibit. You are creating a scheduled analytics rule in Microsoft Sentinel using the ARM template snippet. The rule runs every 5 minutes and queries the last 5 minutes of data. The rule is not generating alerts even though malware detections are occurring. What is the most likely issue?

Accepted Answer

The table DeviceEvents is not ingested into the Log Analytics workspace.. DeviceEvents is a table from Microsoft Defender for Endpoint, but it is not automatically available in Microsoft Sentinel's Log Analytics workspace. The data connector for Microsoft Defender for Endpoint must be configured and the table must be mapped to Sentinel's workspace. Without this, the query runs against an empty table, returning no results, so the rule never triggers (even with triggerThreshold of 0). Option A is incorrect: having queryPeriod and queryFrequency both set to 5 minutes is standard for a rule that runs every 5 minutes looking at the last 5 minutes; it does not cause overlapping windows. Option B is incorrect: triggerThreshold of 0 means any result should trigger an alert, but if there are no results due to missing data, the rule won't fire. Option C is incorrect: the ARM template snippet would include the required 'kind' property for a scheduled rule; its absence is not the issue here.

Answer

The queryPeriod and queryFrequency are the same, causing overlapping windows.

Answer

The triggerThreshold is set to 0, which should always trigger.

Answer

The ARM template is missing the required 'kind' property.

Question 14

Refer to the exhibit. You are troubleshooting an endpoint that is not receiving real-time protection from Microsoft Defender Antivirus. The output shows RealTimeProtectionEnabled is False. Which command should you run next to enable real-time protection?

Accepted Answer

Set-MpPreference -DisableRealtimeMonitoring $false. The Set-MpPreference cmdlet with the -DisableRealtimeMonitoring $false parameter is the correct command to enable real-time protection in Microsoft Defender Antivirus. The output shows RealTimeProtectionEnabled is False, which directly corresponds to the DisableRealtimeMonitoring setting; setting it to $false re-enables the feature. This cmdlet modifies the local policy for the Microsoft Defender Antivirus engine, immediately activating real-time scanning of file operations and process activity.

Answer

Add-MpPreference -ExclusionPath C:\Temp

Answer

Start-MpScan

Answer

Update-MpSignature

Question 15

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. You need to ensure that all cloud security alerts are automatically ingested into Sentinel. What should you configure?

Accepted Answer

Configure the Microsoft Defender for Cloud data connector (Legacy).. The Microsoft Defender for Cloud data connector (Legacy) is the correct choice because it specifically ingests security alerts from Microsoft Defender for Cloud into Microsoft Sentinel. This connector ensures that all alerts generated by Defender for Cloud's security policies and threat detection are automatically streamed into Sentinel for centralized monitoring and incident response.

Answer

Configure the Microsoft 365 Defender data connector.

Answer

Configure the Azure Activity data connector.

Answer

Create a custom log table and a PowerShell script to push alerts.