SC-200 Manage a security operations environment Practice Test 12 — 15 Questions

Question 1

You are configuring Microsoft Defender for Cloud Apps session controls for a SharePoint site containing sensitive data. Which condition must be met to apply real-time monitoring?

Accepted Answer

Users must access the site through Microsoft Entra ID application proxy.. Microsoft Defender for Cloud Apps session controls for SharePoint require traffic to be routed through Microsoft Entra ID (formerly Azure AD) to enable real-time monitoring and control. The Microsoft Entra ID application proxy acts as a reverse proxy that intercepts user requests, allowing Defender for Cloud Apps to inspect and apply policies on the fly. Without this proxy, the session control cannot intercept traffic at the application layer for SharePoint Online.

Answer

The SharePoint site must be added as a custom app in Defender for Cloud Apps.

Answer

A browser extension must be installed on all client devices.

Answer

Users must be configured with Conditional Access policies from Microsoft Entra ID.

Question 2

Your Microsoft Sentinel workspace ingests logs from multiple sources but you notice that some custom logs are missing in the Log Analytics workspace. You've confirmed that the data connectors are healthy. What is the most likely cause?

Accepted Answer

The custom log table schema does not match the incoming log format.. When data connectors are healthy but custom logs are missing, the most common cause is a schema mismatch between the custom log table definition in the Log Analytics workspace and the actual log data being sent. Microsoft Sentinel requires the custom log table's schema (columns, data types, and delimiters) to exactly match the incoming log format; otherwise, the ingestion pipeline drops the records without error. This is because the Log Analytics agent or AMA uses the table schema to parse and transform the data, and any deviation results in silent failures.

Answer

There is a time gap between log generation and ingestion.

Answer

The workspace has exceeded its daily ingestion limit.

Answer

The data connectors are not properly configured for custom log ingestion.

Question 3

You are designing an automation rule in Microsoft Sentinel that should automatically assign incidents to the appropriate analyst based on the incident type. However, the rule fails to assign correctly for some incidents. What should you verify?

Accepted Answer

The order of conditions in the automation rule; ensure more specific conditions are evaluated first.. Automation rules in Microsoft Sentinel evaluate conditions in order, and the first matching condition triggers the associated action. If a broad condition (e.g., 'all incidents') is placed before a more specific condition (e.g., 'incident type equals Phishing'), the broad rule will match first and assign incorrectly, preventing the specific rule from ever running. Reordering conditions so that the most specific ones are evaluated first ensures correct assignment based on incident type.

Answer

That a playbook has been created to perform the assignment.

Answer

That the incident assignment rule in Microsoft Entra ID is configured correctly.

Answer

That the owner (analyst) has the required permissions in Microsoft Sentinel.

Question 4

Your organization is migrating from Azure Active Directory to Microsoft Entra ID. You need to ensure that Microsoft Sentinel continues to receive identity logs. What should you do?

Accepted Answer

No action is required; the existing connector automatically updates.. Option A is correct because Entra ID is the same service; connectors remain. Option B is wrong because logs are free. Option C is wrong because Microsoft 365 Defender is separate. Option D is wrong because no migration is needed.

Answer

Install the new Microsoft 365 Defender connector for identity logs.

Answer

Reconfigure the diagnostic settings to send logs to a new Log Analytics workspace.

Answer

Create a new data connector for Microsoft Entra ID.

Question 5

You have deployed Microsoft Defender for Endpoint and integrated it with Microsoft Sentinel. You notice that alerts from Defender for Endpoint are not appearing in Sentinel. What should you check first?

Accepted Answer

Verify that the Microsoft 365 Defender connector in Sentinel is enabled and configured.. The Microsoft 365 Defender connector in Microsoft Sentinel is the specific data connector responsible for ingesting alerts from Microsoft Defender for Endpoint (and other Defender products). If this connector is not enabled or misconfigured, alerts will not flow into Sentinel regardless of licensing, device onboarding, or analytics rules. This is the first and most direct check because the connector acts as the ingestion pipeline.

Answer

Confirm that Defender for Endpoint is licensed for all users.

Answer

Check that the alert severity is not being filtered out by analytics rules.

Answer

Ensure that all devices are onboarded to Defender for Endpoint.

Question 6

You are configuring an automated investigation and response (AIR) playbook in Microsoft Sentinel. The playbook should automatically block a user in Microsoft Entra ID when a high-severity incident is created. Which action should you include in the playbook?

Accepted Answer

Call the Microsoft Graph API to update the user's accountEnabled property to false.. Option B is correct because the 'Block user' action is not available in the Microsoft Entra ID connector for Azure Logic Apps; instead, you must call the Microsoft Graph API to update the user's `accountEnabled` property to `false`. This directly disables the user account in Microsoft Entra ID, effectively blocking their access. The playbook in Microsoft Sentinel uses Azure Logic Apps, and the Graph API is the appropriate method to perform this action programmatically.

Answer

Use the 'Block user' action from the Microsoft Entra ID connector in Azure Logic Apps.

Answer

Add a 'Block IP' action from the Azure Firewall connector.

Answer

Add a 'Change incident status' action to close the incident.

Question 7

Which TWO actions can reduce the cost of Microsoft Sentinel while maintaining security coverage?

Accepted Answer

Configure some tables to use Basic Logs tier.. Options A and C are correct because archiving reduces retention cost and Basic Logs reduce ingestion cost. Option B is wrong because deleting logs reduces coverage. Option D is wrong because decreasing retention deletes logs sooner. Option E is wrong because Sentinel costs are separate from Log Analytics.

Answer

Remove unused data connectors.

Answer

Switch to a pay-as-you-go workspace.

Answer

Reduce workspace retention to 30 days for all tables.

Question 8

Which THREE components are required to use Microsoft Sentinel's automation rules to automatically respond to incidents?

Accepted Answer

The appropriate permissions to run playbooks.. Option C is correct because automation rules require appropriate permissions (e.g., Microsoft Sentinel Contributor or Automation Contributor) to execute playbooks. Without these permissions, the automation rule cannot invoke the playbook when an incident is created or updated, even if the rule and playbook are properly configured.

Answer

A playbook created in Azure Logic Apps.

Answer

An analytics rule generating alerts.

Question 9

Which TWO Microsoft Sentinel features allow you to organize and prioritize incidents for better triage?

Accepted Answer

Incident assignment to analysts.. Options A and D are correct. Option B is wrong because playbooks are for response. Option C is wrong because workbooks are for visualization. Option E is wrong because entities are components of incidents.

Answer

Entity mapping in analytics rules.

Answer

Automation rules with incident creation triggers.

Answer

Workbooks for dashboard reporting.

Question 10

Your security team receives frequent false positive alerts from Microsoft Defender for Cloud Apps. You need to reduce noise without disabling any threat detection policies. What should you do?

Accepted Answer

Configure suppression rules based on user, IP, or app to automatically dismiss matching alerts.. Option B is correct because suppression rules in Microsoft Defender for Cloud Apps allow you to automatically dismiss alerts that match specific criteria (e.g., user, IP address, or app) without disabling the underlying threat detection policy. This reduces false positive noise while keeping the detection engine active for genuine threats. Disabling policies or adjusting severity thresholds would either remove detection entirely or fail to address the root cause of false positives.

Answer

Disable the built-in anomaly detection policies that generate false positives.

Answer

Adjust the alert severity thresholds in the policy settings.

Answer

Create custom detection policies to override default rules.

Question 11

You are managing a Microsoft Sentinel environment. You need to ensure that incidents are automatically assigned to the appropriate analyst based on the type of attack. The assignment must consider the current workload of each analyst. What should you use?

Accepted Answer

Use an automation rule with a playbook that queries the current incident assignments and assigns to the least busy analyst.. Option B is correct because automation rules in Microsoft Sentinel can trigger a playbook (Azure Logic App) that queries the current incident assignments and assigns the incident to the analyst with the fewest active incidents. This satisfies both the attack-type mapping (via the analytics rule that generates the incident) and the workload-balancing requirement, as the playbook can dynamically evaluate workload using Azure Resource Graph or Sentinel's API.

Answer

Configure multiple analytics rules, each with a different incident owner.

Answer

Create a watchlist that maps attack types to analyst names and use it in an analytics rule.

Answer

Create a workbook that shows analyst workload and manually assign.

Question 12

Your organization uses Microsoft Defender XDR. You need to ensure that all cloud app alerts are forwarded to Microsoft Sentinel for correlation. What should you configure?

Accepted Answer

In Microsoft Sentinel, enable the data connector for Microsoft Defender for Cloud Apps.. Option C is correct because the Microsoft Defender for Cloud Apps data connector in Microsoft Sentinel is specifically designed to ingest alerts and cloud discovery logs from Defender for Cloud Apps. Enabling this connector ensures that all cloud app alerts are automatically forwarded to Sentinel for correlation without requiring custom API queries or external export pipelines.

Answer

Create an analytics rule in Sentinel that queries Defender for Cloud Apps API.

Answer

Configure Microsoft Defender for Cloud Apps to export alerts to Azure Event Hubs.

Answer

In Microsoft Sentinel, enable the data connector for Microsoft Defender for Endpoint.

Question 13

You are responsible for Microsoft Defender for Identity. The security team reports that some high-confidence alerts are not triggering any automated response. You need to automate the response for these alerts. What should you configure?

Accepted Answer

In Microsoft Defender XDR, configure automated investigation and response for Identity alerts.. Option C is correct because Microsoft Defender for Identity alerts are natively integrated into Microsoft Defender XDR (formerly Microsoft 365 Defender), which provides automated investigation and response (AIR) capabilities. By configuring AIR for Identity alerts in Defender XDR, you can automatically trigger remediation actions such as suspending compromised accounts or blocking suspicious activities without additional scripting or third-party tools.

Answer

Use Microsoft Intune to trigger a script on domain controllers when an alert fires.

Answer

Create an automation rule in Microsoft Sentinel to respond to Identity alerts.

Answer

Configure Microsoft Purview compliance policies to respond to Identity alerts.

Question 14

Your Microsoft Sentinel workspace has multiple analytics rules generating incidents. You need to automatically group related incidents from different rules into a single incident to reduce analyst workload. The grouping should occur within 30 minutes of the first incident creation. What should you do?

Accepted Answer

Configure incident grouping in the analytics rule settings with a matching condition and a 30-minute time window.. Option B is correct because Microsoft Sentinel's analytics rules support incident grouping, which automatically merges alerts that match specified conditions (e.g., same entity) into a single incident. By setting the grouping time window to 30 minutes, you ensure that related incidents from different rules are combined within that period, reducing analyst workload without requiring manual intervention or custom playbooks.

Answer

Use an automation rule with a playbook that queries for related incidents and merges them.

Answer

Create an incident creation rule that groups alerts from multiple analytics rules based on entity matching.

Answer

Create a workbook to display related incidents and manually merge them.

Question 15

Your organization uses Microsoft Defender for Office 365. You need to ensure that when a user reports a phishing email, the email is automatically analyzed and remediated. What should you configure?

Accepted Answer

Configure User Reported Message settings to use the built-in reporting tool and automated investigation.. Option C is correct because the User Reported Message settings in Defender for Office 365 allow you to configure what happens when users report messages, including automated investigation and remediation. Option A is wrong because Safe Attachments is for scanning attachments. Option B is wrong because Safe Links is for URL protection. Option D is wrong because Anti-Phish policies detect phishing but don't handle user reports.

Answer

Configure Anti-Phish policy to move messages to quarantine.

Answer

Enable Safe Attachments policy.

Answer

Enable Safe Links policy.