SC-200 Manage a security operations environment Practice Test 13 — 15 Questions

Question 1

Your security team uses Microsoft Sentinel UEBA to detect anomalous user behavior. You need to configure UEBA to baseline user activities and generate alerts for deviations. What must you do first?

Accepted Answer

Enable UEBA in the Sentinel Settings blade and select relevant data sources.. Microsoft Sentinel UEBA requires explicit enablement in the Sentinel Settings blade under the 'Entity behavior analytics' section. Once enabled, you must select the relevant data sources (e.g., Microsoft Entra ID sign-in logs, Office 365 audit logs, Windows Security Events) so that Sentinel can baseline normal user behavior patterns and generate alerts for anomalous deviations. Without this initial configuration, UEBA cannot process any data or produce behavioral analytics.

Answer

Create an Azure Machine Learning workspace for anomaly detection.

Answer

Assign Microsoft 365 E5 licenses to all users.

Answer

Deploy a custom data connector for HR systems.

Question 2

Your company uses Microsoft Defender for Office 365. You want to automatically take action on malicious emails that bypass the filter. What should you configure?

Accepted Answer

Configure automated investigation and response (AIR) policies.. Automated investigation and response (AIR) policies in Microsoft Defender for Office 365 are specifically designed to automatically take action on malicious emails that bypass initial filters. AIR uses playbooks to investigate threats and automatically remediate, such as deleting or moving emails, without manual intervention. This directly addresses the requirement to automatically act on bypassed malicious emails.

Answer

Enable anti-phishing policy.

Answer

Enable Safe Attachments policy.

Answer

Create a transport rule in Exchange.

Question 3

Your organization has Microsoft Defender for Endpoint deployed. You need to configure automatic attack disruption for ransomware attacks. What should you enable?

Accepted Answer

Automatic attack disruption in Microsoft 365 Defender.. Automatic attack disruption in Microsoft 365 Defender is the correct feature to enable because it uses advanced detection signals to automatically contain compromised assets during ransomware attacks, such as isolating devices or blocking accounts, without manual intervention. This capability is specifically designed to stop the spread of ransomware in real time by leveraging Microsoft's threat intelligence and behavioral analytics.

Answer

Attack surface reduction rules.

Answer

Live Response capabilities.

Answer

Device discovery settings.

Question 4

Your team uses Microsoft Sentinel to investigate incidents. You need to create a custom analytic rule that triggers an incident when a user signs in from an unfamiliar location. What is the most efficient way to achieve this?

Accepted Answer

Use a built-in Anomalous Sign-in Location rule template.. Microsoft Sentinel provides a built-in 'Anomalous Sign-in Location' rule template that leverages Microsoft Entra ID Identity Protection data to detect sign-ins from unfamiliar locations. This template is pre-configured with the necessary KQL logic and alerting, making it the most efficient method without requiring custom development or additional data sources.

Answer

Create a playbook triggered by Microsoft Entra ID alerts.

Answer

Write a custom KQL query using SigninLogs.

Answer

Configure a Microsoft Purview insider risk policy.

Question 5

Your organization uses Microsoft Defender for Cloud Apps. You need to block downloads from unmanaged devices for a specific cloud app. What should you configure?

Accepted Answer

Create a session policy with device tag condition.. Session policies in Microsoft Defender for Cloud Apps allow you to control user activities in real time based on device tags. By configuring a session policy with a device tag condition (e.g., 'Device tag equals Unmanaged'), you can enforce actions like blocking downloads from unmanaged devices for a specific cloud app, leveraging reverse proxy architecture to inspect and control traffic.

Answer

Create a file policy with a governance action.

Answer

Create an app permissions policy.

Answer

Create an anomaly detection policy.

Question 6

Your Microsoft Sentinel workspace is ingesting data from multiple sources. You need to ensure that data from a specific source is retained for 2 years while other data remains at the default retention. What should you do?

Accepted Answer

Create a custom table for that source and set its retention to 2 years.. In Microsoft Sentinel, retention is set at the table level. By creating a custom table for the specific data source and configuring its retention period to 2 years, you can override the default workspace retention for that table only. This allows other tables to retain the default retention setting while the custom table retains data for the required duration.

Answer

Adjust the data ingestion settings for that source.

Answer

Set the workspace retention to 2 years.

Answer

Configure archiving for that source's data.

Question 7

Your organization uses Microsoft Defender for Identity. You receive an alert about a suspicious Kerberos ticket request. What is the most appropriate first step?

Accepted Answer

Investigate the alert in the Microsoft 365 Defender portal.. The first step when receiving any security alert, including a suspicious Kerberos ticket request from Microsoft Defender for Identity, is to investigate the alert in the Microsoft 365 Defender portal. This portal provides the unified security operations console where you can view the full alert details, related entities, and the MITRE ATT&CK mapping to understand the scope and severity before taking any remediation actions. Prematurely disabling accounts or resetting passwords without investigation can destroy forensic evidence and potentially disrupt legitimate user activity.

Answer

Disable the user account.

Answer

Reset the user's password.

Answer

Reset the krbtgt account password.

Question 8

Which THREE components are part of Microsoft's unified security operations platform (Microsoft Defender XDR)?

Accepted Answer

Microsoft Defender for Endpoint.. Microsoft Defender XDR is Microsoft's unified security operations platform that integrates signals from across the Microsoft 365 ecosystem. Microsoft Defender for Endpoint is a core component, providing endpoint detection and response (EDR) capabilities, including behavioral-based detection, automated investigation, and threat hunting on Windows, macOS, Linux, Android, and iOS devices. It contributes telemetry such as process creation, network connections, and file events to the unified incident and alert correlation in the Defender XDR portal.

Answer

Microsoft Intune.

Answer

Microsoft Sentinel.

Question 9

Which TWO features are available in Microsoft Sentinel to automate incident response?

Accepted Answer

Playbooks based on Azure Logic Apps.. Playbooks based on Azure Logic Apps (A) are the core automation mechanism in Microsoft Sentinel: they are Logic Apps workflows triggered by analytics rules or incidents that can run actions such as blocking an IP, posting to Teams, or opening a ticket, so they directly automate incident response. Automation rules (E) are also correct because they let you centrally manage and orchestrate incident handling — assigning owners, changing severity or status, tagging, and triggering playbooks — without writing code, which is exactly automation of incident response. Workbooks (B) are only for visualization and reporting dashboards, and KQL queries (C) are the query language used for hunting and analytics, not an automation feature. UEBA (D) provides behavioral analytics and entity insights to enrich detection, but it does not itself automate response actions.

Answer

Workbooks.

Answer

Kusto Query Language (KQL) queries.

Answer

UEBA.

Question 10

Refer to the exhibit. You are reviewing a Microsoft Sentinel analytics rule created via ARM template. What is the effect of the grouping configuration?

Accepted Answer

Groups alerts into one incident if all entities match within a 5-hour lookback.. The grouping configuration in the exhibit sets the grouping condition to 'Group alerts into a single incident if all entities match' with a 5-hour lookback period. This means that alerts generated within 5 hours that share identical entities (e.g., same IP, host, or account) will be merged into one incident, reducing alert noise. Option D correctly describes this behavior, as it specifies both the entity matching requirement and the time window.

Answer

Groups alerts into one incident if any entity matches.

Answer

Creates a separate incident for each alert.

Answer

Suppresses alerts for 5 hours after the first alert.

Question 11

Refer to the exhibit. You run the PowerShell command against Microsoft Defender for Endpoint. What is the result?

Accepted Answer

An antivirus scan runs on the device.. The `Start-MpScan` cmdlet initiates a Microsoft Defender Antivirus scan on the device. The `-ScanType` parameter with value `QuickScan` specifies a quick scan of common malware locations, not a full scan. This is a direct antivirus action, not an investigation package collection, isolation, or Live Response session.

Answer

The investigation package is collected.

Answer

The device is isolated from the network.

Answer

A Live Response session is started.

Question 12

Refer to the exhibit. You run this KQL query in Microsoft Sentinel. What does it return?

Accepted Answer

Top 5 incident owners by number of high-severity incidents in the last 7 days.. The KQL query uses `summarize` with `count()` by `Owner`, then `top 5 by count_`, and filters with `where Severity == 'High'` and `TimeGenerated > ago(7d)`. This returns the top 5 incident owners ranked by the number of high-severity incidents they own in the last 7 days, making option C correct.

Answer

Number of high-severity incidents per status.

Answer

Total count of high-severity incidents in the last 7 days.

Answer

Top 5 users assigned to high-severity incidents.

Question 13

Your organization has a hybrid identity environment with Microsoft Entra ID and on-premises Active Directory. You are configuring Microsoft Defender for Identity to protect against lateral movement attacks. Which configuration should you prioritize to detect pass-the-hash attacks?

Accepted Answer

Enable 'Capture NTLM hashes' in the Microsoft Defender for Identity sensor configuration. Enabling 'Capture NTLM hashes' in the Microsoft Defender for Identity sensor configuration allows the sensor to extract NTLM hashes from network traffic. Pass-the-hash attacks rely on capturing and reusing NTLM hashes to authenticate laterally; by capturing these hashes, Defender for Identity can detect anomalies such as a hash being used from a different source or for suspicious logon attempts, directly identifying the attack.

Answer

Configure port mirroring for domain controllers

Answer

Enable 'SAM-R' (Remote SAM) in the Microsoft Defender for Identity sensor configuration

Answer

Configure Windows Event Forwarding (WEF) for domain controllers

Question 14

Your organization uses Microsoft Sentinel to manage security incidents. You need to ensure that critical incidents are automatically assigned to the senior security analyst on duty. What should you configure?

Accepted Answer

Configure an automation rule with an 'Assign incident' action. Automation rules in Microsoft Sentinel allow you to automatically assign incidents to a specific owner based on conditions such as severity or title. Configuring an automation rule with the 'Assign incident' action ensures critical incidents are routed to the senior analyst on duty without manual intervention. This is the native, no-code method for incident assignment.

Answer

Modify the analytics rule to set the owner in the incident creation

Answer

Create a playbook that assigns incidents

Answer

Use a workbook to filter incidents by severity and assign manually

Question 15

Your organization uses Microsoft Defender for Cloud Apps to discover shadow IT. You notice that a new cloud app is being used by multiple users but has a risk score of 8. What should you do first to manage the risk?

Accepted Answer

Investigate the app's risk factors and user activity. A risk score of 8 indicates the app is high-risk, but immediate blocking or unsanctioning could disrupt business operations if the app is legitimate or used for approved purposes. The first step is to investigate the app's risk factors (e.g., data residency, encryption standards, compliance certifications) and user activity (e.g., volume of data uploaded, types of files shared) to understand the actual threat. This aligns with Microsoft's recommended incident response process: assess before acting.

Answer

Block the app at the proxy

Answer

Immediately unsanction the app in Defender for Cloud Apps

Answer

Create a policy to alert on use of this app