SC-200 Manage a security operations environment Practice Test 14 — 15 Questions

Question 1

Which TWO permissions are required to configure a data connector in Microsoft Sentinel?

Accepted Answer

Log Analytics Contributor. To configure a data connector in Microsoft Sentinel, you need both Microsoft Sentinel Contributor (to manage Sentinel resources like data connectors) and Log Analytics Contributor (to manage the Log Analytics workspace where the data is stored). Option A (Log Analytics Contributor) and Option E (Microsoft Sentinel Contributor) are correct. Option B (Microsoft Sentinel Reader) provides read-only access and is insufficient. Option C (Global Administrator) is overly broad and unnecessary. Option D (Security Admin) does not grant the required workspace-level permissions.

Answer

Microsoft Sentinel Reader

Answer

Global Administrator

Answer

Security Admin

Question 2

Which THREE components are part of the Microsoft Defender XDR incident management process?

Accepted Answer

Entities. Entities are a core component of the Microsoft Defender XDR incident management process because they represent the assets (such as users, devices, mailboxes, and applications) that are involved in an incident. The incident graph automatically links related entities to provide a unified view of the attack story, enabling analysts to pivot from an alert to the affected resources for investigation and response.

Answer

User settings

Answer

Playbooks

Question 3

Which TWO actions can you perform using Microsoft Sentinel automation rules?

Accepted Answer

Change incident status. Automation rules in Microsoft Sentinel allow you to automatically manage incidents by changing their status (e.g., from 'New' to 'Active' or 'Closed') based on conditions like severity or title. They can also trigger playbooks (automated response workflows) when incidents are created or updated, enabling actions such as enrichment, investigation, or remediation. These capabilities are defined in the automation rule's 'Actions' section, where you set the incident status or select a playbook to run.

Answer

Create a new analytics rule

Answer

Modify a data connector

Answer

Delete an incident

Question 4

Which THREE conditions can you use to trigger a Microsoft Sentinel scheduled analytics rule?

Accepted Answer

Custom threshold on a specific field. Microsoft Sentinel scheduled analytics rules allow you to set a custom threshold on a specific field within the query results. This condition triggers an alert when the aggregated value of that field (e.g., count, sum, or average) meets or exceeds the defined threshold, enabling precise detection of anomalies like excessive failed logins from a single user.

Answer

Query results include a specific IP address

Answer

Time since last alert for a given entity exceeds a value

Question 5

You are a security analyst for a multinational company with Microsoft Sentinel deployed in a central workspace. You need to grant a team of analysts in the European branch the ability to view incidents and run queries, but they should not be able to modify analytics rules or data connectors. The team already has Microsoft Sentinel Reader role assigned. However, they report that they cannot run KQL queries in the Logs blade. You need to provide the minimum additional permissions. What should you do?

Accepted Answer

Assign the Log Analytics Reader role to the team on the Sentinel workspace.. The Microsoft Sentinel Reader role grants read access to Sentinel data, including incidents, but does not include the ability to run KQL queries in the Logs blade because that requires read permissions on the underlying Log Analytics workspace. The Log Analytics Reader role provides the necessary read access to log data and the ability to execute queries without granting write permissions to analytics rules or data connectors, fulfilling the requirement with minimal privileges.

Answer

Assign the Log Analytics Contributor role to the team on the Sentinel workspace.

Answer

Assign the Microsoft Sentinel Contributor role to the team on the Sentinel workspace.

Answer

Assign the Reader role to the team on the Sentinel workspace.

Question 6

You are a security operations analyst at a company that uses Microsoft Defender XDR and Microsoft Sentinel. You have configured a custom detection rule in Microsoft Defender XDR that uses a KQL query to detect suspicious PowerShell activity. The rule triggers an alert, but you want to automatically create an incident in Microsoft Sentinel and run a playbook that isolates the affected device. You have already set up the Microsoft Defender XDR connector in Sentinel and enabled incident creation from Defender XDR alerts. However, the playbook does not run automatically when a Defender XDR incident is created. You have verified that the playbook is properly configured and has the correct permissions. What should you do?

Accepted Answer

Create an automation rule in Microsoft Sentinel that triggers on incident creation and runs the playbook.. In Microsoft Sentinel, automation rules are the mechanism to trigger playbooks automatically when incidents are created or updated. Since the Defender XDR connector is already enabled and creating incidents in Sentinel, the missing piece is an automation rule in Sentinel that runs the playbook on incident creation. The playbook itself is properly configured, so the automation rule bridges the gap between incident creation and playbook execution.

Answer

Create an automation rule in Microsoft Defender XDR to run the playbook.

Answer

Modify the Microsoft Defender XDR data connector in Sentinel to enable playbook execution.

Answer

Modify the custom detection rule in Defender XDR to include a 'run playbook' action.

Question 7

Your security operations team uses Microsoft Sentinel workbooks to monitor security posture. You notice that a workbook query is timing out when run against a large workspace. What is the best way to optimize the query without changing its results?

Accepted Answer

Use the workspace() function to query specific workspaces only.. The `workspace()` function in KQL allows you to explicitly scope a query to specific workspaces, reducing the data scanned and improving performance. By targeting only the necessary workspaces, you avoid the overhead of querying the entire large workspace, which is the root cause of the timeout. This optimization does not alter the query logic or results, as it simply restricts the data source.

Answer

Remove some filter conditions to simplify the query.

Answer

Add a summarize operator at the end of the query.

Answer

Reduce the time range of the query.

Question 8

Your organization is implementing Microsoft Sentinel in a multi-tenant environment using Azure Lighthouse. The SOC team needs to investigate incidents across all tenants from a single interface. Which configuration is required?

Accepted Answer

Onboard multiple workspaces to Azure Lighthouse and use a central workspace for investigation.. Azure Lighthouse enables cross-tenant management by allowing the SOC team to delegate access to multiple Sentinel workspaces from a single control plane. This configuration lets investigators view and manage incidents across all tenants without needing separate sign-ins or duplicating data, which is essential for a multi-tenant SOC environment.

Answer

Use Azure AD B2B to grant users from other tenants access to the workspace.

Answer

Create a single workspace and have all tenants send logs to it.

Answer

Assign custom roles in each tenant's Sentinel workspace.

Question 9

Your Microsoft Sentinel workspace is experiencing high ingestion costs. Which of the following actions will most effectively reduce costs while maintaining security visibility?

Accepted Answer

Configure Basic Logs for verbose logs like Windows events from non-critical servers.. Configuring Basic Logs for verbose logs (e.g., Windows Event ID 4688 from non-critical servers) reduces ingestion costs by storing them in a lower-cost tier while still retaining them for security investigations. Basic Logs are charged at a lower ingestion rate and support simple queries and search jobs, preserving visibility for incident response without the full cost of Analytics Logs.

Answer

Delete unused analytics rules to reduce log ingestion.

Answer

Disable collection of all informational logs.

Answer

Reduce the data retention period to 30 days.

Question 10

Your organization uses Microsoft Sentinel with UEBA (User and Entity Behavior Analytics) enabled. The SOC team notices that UEBA is not generating any anomalies for a specific user group. What is the most likely cause?

Accepted Answer

The data history for that user group is less than the required baseline period.. UEBA (User and Entity Behavior Analytics) requires a minimum baseline period of at least 14 days of data to learn normal behavior. Without sufficient historical data for the user group, anomalies cannot be generated. Option A is incorrect because excluding a user group from Identity Protection does not affect UEBA, which operates independently. Option C is incorrect because data connectors may be present, but the issue is the lack of historical data, not monitoring. Option D is incorrect because UEBA uses its own machine learning models and does not require analytics rules to be enabled.

Answer

The user group is excluded from Identity Protection.

Answer

The user group is not being monitored by any data connector.

Answer

The analytics rules for UEBA are not enabled.

Question 11

Your organization uses Microsoft Defender for Office 365. You want to automatically isolate a user's mailbox if a high-confidence phishing email is detected. Which Microsoft Sentinel automation should you use?

Accepted Answer

Create a playbook that uses the Microsoft Graph API to apply a mailbox litigation hold or block access.. Microsoft Sentinel playbooks, built on Azure Logic Apps, can use the Microsoft Graph API to perform automated remediation actions like applying a mailbox litigation hold or blocking user access. This enables automatic isolation of a user's mailbox when a high-confidence phishing email is detected, which is a key incident response capability in Defender for Office 365.

Answer

Configure a workbook to display the alert and manually isolate the mailbox.

Answer

Enable the Office 365 connector and configure automatic response in the data connector.

Answer

Create a scheduled analytics rule that isolates the mailbox when triggered.

Question 12

Your SOC team uses Microsoft Sentinel incident management. They want to automatically assign high-severity incidents to a senior analyst and send a notification to Microsoft Teams. What should you use?

Accepted Answer

Create an automation rule that triggers on incident creation, assigns the incident, and runs a playbook to post to Teams.. Automation rules in Microsoft Sentinel can trigger on incident creation (e.g., when severity is 'High'), automatically assign the incident to a specific owner (senior analyst), and then invoke a playbook (Azure Logic App) to post a message to Microsoft Teams. This combines assignment logic with automated notification in a single, manageable rule.

Answer

Create a playbook and attach it directly to the analytics rule.

Answer

Create a watchlist to define assignment rules and configure a workbook for notifications.

Answer

Create an analytics rule with incident grouping and assignment.

Question 13

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. The SOC team needs to investigate a cross-tenant incident. Which TWO actions should you take? (Choose two.)

Accepted Answer

Use the Microsoft Defender XDR unified incident queue to view incidents across tenants.. The Microsoft Defender XDR unified incident queue can display incidents from multiple tenants when properly configured, enabling cross-tenant investigation without additional licensing. This feature leverages Azure Lighthouse delegated access to aggregate alerts and incidents across tenants into a single view, streamlining SOC workflows.

Answer

Install the Microsoft Sentinel solution for each tenant separately.

Answer

Create a workspace query using the union operator to combine data from all tenants.

Question 14

Your organization uses Microsoft Sentinel and Microsoft Copilot for Security. You want to improve incident response efficiency. Which THREE features should you implement? (Choose three.)

Accepted Answer

Enable Microsoft Copilot for Security to assist with incident investigations.. Microsoft Copilot for Security integrates directly with Microsoft Sentinel to provide AI-driven natural language assistance for incident investigations, enabling analysts to query data, summarize incidents, and generate KQL queries without manual scripting. This directly improves incident response efficiency by reducing investigation time and cognitive load.

Answer

Use watchlists to track known malicious IP addresses.

Answer

Configure workbooks to display real-time incident trends.

Question 15

Your organization plans to implement Microsoft Sentinel. Which THREE components are required for a basic deployment? (Choose three.)

Accepted Answer

Analytics rules to generate incidents.. Analytics rules are required to generate incidents from the data ingested into Microsoft Sentinel. Without analytics rules, the raw log data remains unprocessed and no security incidents are created, making the deployment non-functional for detection and response.

Answer

User and Entity Behavior Analytics (UEBA) enabled.

Answer

Bookmarks for incident investigations.