SC-200 Manage a security operations environment Practice Test 13 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You want to ensure that incidents generated in Microsoft 365 Defender are automatically synchronized to Microsoft Sentinel. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable the Microsoft Defender XDR data connector in Microsoft Sentinel. The Microsoft Defender XDR data connector in Microsoft Sentinel is specifically designed to synchronize incidents from Microsoft 365 Defender into Sentinel. When enabled, this connector uses the Microsoft Graph Security API to ingest incidents, alerts, and evidence, ensuring automatic and bidirectional synchronization without requiring additional automation rules or analytics queries.

Answer

Set up an automation rule to import incidents

Answer

Configure the Microsoft Sentinel connector in Microsoft Defender XDR

Answer

Create an analytics rule to query Defender XDR data

Question 2

You are investigating a security incident in Microsoft Sentinel. You need to preserve a snapshot of the investigation including comments, bookmarks, and entities for future reference. What should you do?

Accepted Answer

Create a bookmark with the relevant data. Bookmarks in Microsoft Sentinel allow you to preserve a snapshot of an investigation, including comments, bookmarks, and entities, for future reference. Bookmarks capture the state of an investigation at a specific point in time, enabling you to revisit and share the context later.

Answer

Create an automation rule to tag the incident

Answer

Add the entities to a watchlist

Answer

Close the incident as a false positive

Question 3

Your organization uses Microsoft Defender XDR and Microsoft Sentinel. You need to ensure that when a device is identified as compromised by Defender for Endpoint, an incident is automatically created in Sentinel with high severity. What should you configure?

Accepted Answer

Create an automation rule that triggers when an incident is created and set severity to High. Automation rules in Microsoft Sentinel can be configured to run when an incident is created, and they can set the severity of the incident to High. In this scenario, when Defender for Endpoint identifies a compromised device, the Defender XDR connector creates an incident in Sentinel. The automation rule then immediately elevates the severity to High, meeting the requirement without additional manual steps or complex logic.

Answer

Configure the Defender XDR connector to create incidents

Answer

Write an analytics rule that queries Defender for Endpoint data

Answer

Create a playbook to create an incident from the alert

Question 4

Which TWO are required to enable Microsoft Sentinel to use AI-generated incident summaries?

Accepted Answer

The Security Reader role assigned to the user. Microsoft Sentinel's AI-generated incident summaries require Microsoft Copilot for Security to be enabled, as this feature leverages Copilot's natural language processing capabilities to summarize incidents. Additionally, the user must have the Security Reader role assigned to access and view these summaries within Sentinel, ensuring proper permissions for security data.

Answer

An Azure OpenAI service instance deployed

Answer

A Log Analytics workspace with a premium pricing tier

Answer

A Power BI Pro license

Question 5

Refer to the exhibit. You are reviewing a playbook configuration for Microsoft Sentinel. What does this playbook do?

Accepted Answer

It runs when a high severity incident is created. The playbook is configured with a trigger condition that specifies 'When a high severity incident is created'. This means the playbook will only execute when an incident with a severity level of 'High' is generated in Microsoft Sentinel. The condition filters out incidents of other severity levels, ensuring the playbook runs exclusively for high-severity incidents.

Answer

It runs only on medium severity incidents

Answer

It runs when a new alert is generated with high severity

Answer

It runs on all incidents regardless of severity

Question 6

Refer to the exhibit. You are analyzing high severity alerts from Microsoft Defender for Endpoint in Microsoft Sentinel. What does this KQL query do?

Accepted Answer

It lists high severity Defender for Endpoint alerts, grouped by name and day, ordered by frequency. The KQL query uses `summarize` with `count()` to group alerts by `AlertName` and `startofday(TimeGenerated)`, then sorts by `count_` descending. This directly produces a list of high severity Defender for Endpoint alerts grouped by name and day, ordered by frequency, matching option C.

Answer

It counts alerts for a specific alert name

Answer

It displays detailed properties of each alert

Answer

It shows all alerts from Defender for Endpoint in the last week

Question 7

Refer to the exhibit. A security administrator runs this PowerShell script. What is the effect?

Accepted Answer

It creates an automation rule that runs a playbook on medium severity incidents. The PowerShell script uses the `New-AzSentinelAutomationRule` cmdlet to create an automation rule in Microsoft Sentinel. The `-TriggerType` parameter is set to `IncidentCreated`, and the `-Action` parameter specifies a playbook to run. The `-TriggeringLogic` parameter filters for incidents with a severity of `Medium`, so the automation rule triggers the playbook only when a medium-severity incident is created.

Answer

It creates a playbook that runs daily for high severity incidents

Answer

It schedules a daily report generation for all incidents

Answer

It creates a playbook named 'DailySummaryReport'

Question 8

You are a security analyst at a company that uses Microsoft Sentinel. You need to ensure that only users with a specific tag in Microsoft Entra ID can access the Sentinel workspace. Which Azure feature should you use?

Accepted Answer

Configure a Conditional Access policy in Microsoft Entra ID.. Conditional Access policies in Microsoft Entra ID can enforce access controls based on user attributes, including tags. By configuring a Conditional Access policy that grants access to Microsoft Sentinel only if the user has a specific tag, you can restrict workspace access at the authentication layer before any Azure RBAC evaluation occurs. This is the correct approach because Conditional Access operates at the identity level, directly controlling which users can authenticate to the Sentinel workspace.

Answer

Assign Azure RBAC roles with a condition on the tag.

Answer

Use Microsoft Entra Privileged Identity Management (PIM) to require approval for access.

Answer

Apply an Azure Policy to deny access if the user does not have the tag.

Question 9

Your organization uses Microsoft Defender XDR. You notice that automated investigations are being blocked for certain devices due to high-severity alerts. You need to ensure that automated actions can proceed for devices with a risk score below 30. What should you configure?

Accepted Answer

Configure a device group with an automated investigation and response rule that excludes devices with a risk score above 30.. Device groups in Microsoft Defender XDR allow you to scope automated investigation and response (AIR) rules based on device risk scores. By creating a device group that excludes devices with a risk score above 30, you ensure that automated actions proceed only for devices meeting your threshold, directly addressing the requirement.

Answer

Disable automated investigation for all devices and rely on manual investigation.

Answer

Adjust the Microsoft Defender for Cloud Apps policy to allow automated actions for low-risk devices.

Answer

Modify the attack surface reduction rules to allow automated actions on low-risk devices.

Question 10

You are configuring Microsoft Sentinel to ingest logs from a third-party firewall via Syslog. The data connector shows 'Connected' but no events are being received. You have verified network connectivity and firewall configuration. What should you check next?

Accepted Answer

Validate that the Data Collection Rule (DCR) is properly configured to ingest the Syslog facility and severity.. When a Syslog data connector shows 'Connected' but no events are received, the most common cause is a misconfigured Data Collection Rule (DCR). The DCR defines which Syslog facilities and severities to collect; if it does not match the firewall's actual Syslog output (e.g., facility 'local0' with severity 'informational'), events will be filtered out before ingestion. Network connectivity and firewall configuration are already verified, so the DCR is the next logical check.

Answer

Verify that the connector has the necessary OAuth permissions in Microsoft Entra ID.

Answer

Check that the user who configured the connector has the Microsoft Sentinel Contributor role.

Answer

Ensure the firewall is registered in Azure Policy as a compliant resource.

Question 11

Your organization uses Microsoft Defender for Cloud to manage security posture. You need to assign a custom initiative to a specific management group to track compliance. Which two components must you create?

Accepted Answer

A policy definition and an initiative definition.. To track compliance for a custom initiative in Microsoft Defender for Cloud, you must first create a custom policy definition that specifies the rules or effects to enforce. Then, you must create an initiative definition (a group of policy definitions) that can be assigned to a management group. This assignment enables Defender for Cloud to evaluate resources against the custom initiative and report compliance.

Answer

An Azure Blueprint and a role assignment.

Answer

An Azure RBAC role and a Log Analytics workspace.

Answer

An Azure Monitor workbook and an alert rule.

Question 12

You are a security operations analyst at a company that uses Microsoft Sentinel. You have enabled User and Entity Behavior Analytics (UEBA) to detect anomalies. A new alert fires indicating a user is logging in from an unusual location. However, the user is a known traveler. How can you reduce false positives without disabling the UEBA rule?

Accepted Answer

Add the user to the entity behavior analytics exclusion list.. Microsoft Sentinel's UEBA allows you to add specific users to an entity behavior analytics exclusion list. This prevents the UEBA engine from generating alerts for that user's anomalous activities, such as logins from unusual locations, without disabling the underlying detection rule. This approach maintains detection coverage for other users while suppressing false positives for known travelers.

Answer

Disable the UEBA anomaly rule for unusual locations.

Answer

Change the alert severity to Informational.

Answer

Increase the lookback period for the anomaly detection.

Question 13

You are reviewing an analytics rule in Microsoft Sentinel. The rule is supposed to alert when a Confidential sensitivity label file is accessed. However, no alerts have been generated despite known accesses. What is the most likely reason?

Accepted Answer

The required data connector for Microsoft Purview Information Protection is not connected.. Microsoft Sentinel relies on data connectors to ingest logs from external sources. For alerts based on sensitivity labels (e.g., Confidential), the required data source is Microsoft Purview Information Protection (formerly Azure Information Protection). If this connector is not connected, Sentinel has no way to receive the label-related events, so no alerts can be generated regardless of the rule logic.

Answer

The suppression duration is set to 5 hours, which suppresses alerts.

Answer

The query frequency and period are too short to capture the events.

Answer

The trigger condition is set to 'GreaterThan' 0, which should fire on any event.

Question 14

Your organization uses Microsoft Defender for Office 365. You need to configure a policy that automatically moves emails containing malware to quarantine before delivery. Which policy type should you use?

Accepted Answer

Antimalware policy.. Antimalware policies in Microsoft Defender for Office 365 are specifically designed to scan inbound and outbound email messages for malware (e.g., viruses, worms, trojans) and automatically quarantine detected threats before delivery. This policy type uses the built-in malware detection engine to inspect attachments and message bodies, ensuring malicious content is blocked at the transport layer.

Answer

Anti-spam policy.

Answer

Safe Attachments policy.

Answer

Anti-phishing policy.

Question 15

You are managing Microsoft Defender for Cloud Apps. You discover that a user is downloading large amounts of data from a sanctioned cloud app. You need to automatically suspend the user's access when the download exceeds 5 GB in 10 minutes. What should you create?

Accepted Answer

An anomaly detection policy with a mass download detection template.. An anomaly detection policy in Microsoft Defender for Cloud Apps can detect unusual user behavior, such as mass file downloads, using predefined templates like 'Mass download by a single user'. This policy can be configured to trigger automatic governance actions, including suspending the user, when the download exceeds a threshold like 5 GB in 10 minutes. It directly addresses the need to automatically suspend access based on volume and time.

Answer

A session policy to block downloads.

Answer

An app connector for the cloud app.

Answer

A data loss prevention (DLP) policy in Microsoft Purview.