SC-200 Manage a security operations environment Practice Test 14 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You want to ensure that incidents generated in Microsoft 365 Defender are automatically synchronized to Microsoft Sentinel. What should you configure?

Accepted Answer

Enable the Microsoft Defender XDR data connector in Microsoft Sentinel. Option D is correct because the Microsoft Defender XDR data connector in Microsoft Sentinel is specifically designed to synchronize incidents from Microsoft 365 Defender into Sentinel. When enabled, this connector uses the Microsoft Graph Security API to ingest incidents, alerts, and evidence, ensuring automatic and bidirectional synchronization without requiring additional automation rules or analytics queries.

Answer

Set up an automation rule to import incidents

Answer

Configure the Microsoft Sentinel connector in Microsoft Defender XDR

Answer

Create an analytics rule to query Defender XDR data

Question 2

You are investigating a security incident in Microsoft Sentinel. You need to preserve a snapshot of the investigation including comments, bookmarks, and entities for future reference. What should you do?

Accepted Answer

Create a bookmark with the relevant data. Option B is correct because bookmarks in Microsoft Sentinel allow you to preserve a snapshot of an investigation, including comments, bookmarks, and entities, for future reference. Bookmarks capture the state of an investigation at a specific point in time, enabling you to revisit and share the context later.

Answer

Create an automation rule to tag the incident

Answer

Add the entities to a watchlist

Answer

Close the incident as a false positive

Question 3

Your organization uses Microsoft Defender XDR and Microsoft Sentinel. You need to ensure that when a device is identified as compromised by Defender for Endpoint, an incident is automatically created in Sentinel with high severity. What should you configure?

Accepted Answer

Create an automation rule that triggers when an incident is created and set severity to High. Option D is correct because automation rules in Microsoft Sentinel can be configured to run when an incident is created, and they can set the severity of the incident to High. In this scenario, when Defender for Endpoint identifies a compromised device, the Defender XDR connector creates an incident in Sentinel. The automation rule then immediately elevates the severity to High, meeting the requirement without additional manual steps or complex logic.

Answer

Configure the Defender XDR connector to create incidents

Answer

Write an analytics rule that queries Defender for Endpoint data

Answer

Create a playbook to create an incident from the alert

Question 4

Which TWO are valid methods to ingest syslog data into Microsoft Sentinel?

Accepted Answer

Use the Syslog data connector from the Content hub. Option A is correct because the Syslog data connector available from the Content hub in Microsoft Sentinel provides a direct, built-in method to ingest syslog data from on-premises or cloud-based syslog sources. This connector uses the Log Analytics agent (or the newer Azure Monitor Agent with a Data Collection Rule) to collect syslog messages forwarded by a syslog daemon, typically over UDP port 514 or TCP, and maps them to the Syslog table in Log Analytics. It is the standard, supported approach for syslog ingestion without requiring third-party tools or custom parsers.

Answer

Configure a syslog forwarder with the Cisco ASIM parser

Answer

Deploy a Splunk Universal Forwarder to send syslog to Sentinel

Answer

Install a Windows-based syslog collector and forward to Sentinel using the Azure Monitor agent

Question 5

Which THREE actions can be performed by automation rules in Microsoft Sentinel?

Accepted Answer

Assign an incident to a specific owner. Option C is correct because automation rules in Microsoft Sentinel can automatically assign incidents to specific owners based on conditions such as severity, entity type, or custom criteria. This action helps streamline incident response by ensuring the right personnel are notified and responsible for handling the incident without manual intervention.

Answer

Modify a data connector to ingest more logs

Answer

Create a new analytics rule

Question 6

Which TWO are required to enable Microsoft Sentinel to use AI-generated incident summaries?

Accepted Answer

The Security Reader role assigned to the user. Microsoft Sentinel's AI-generated incident summaries require Microsoft Copilot for Security to be enabled, as this feature leverages Copilot's natural language processing capabilities to summarize incidents. Additionally, the user must have the Security Reader role assigned to access and view these summaries within Sentinel, ensuring proper permissions for security data.

Answer

An Azure OpenAI service instance deployed

Answer

A Log Analytics workspace with a premium pricing tier

Answer

A Power BI Pro license

Question 7

Refer to the exhibit. You are reviewing a playbook configuration for Microsoft Sentinel. What does this playbook do?

Accepted Answer

It runs when a high severity incident is created. The playbook is configured with a trigger condition that specifies 'When a high severity incident is created'. This means the playbook will only execute when an incident with a severity level of 'High' is generated in Microsoft Sentinel. The condition filters out incidents of other severity levels, ensuring the playbook runs exclusively for high-severity incidents.

Answer

It runs only on medium severity incidents

Answer

It runs when a new alert is generated with high severity

Answer

It runs on all incidents regardless of severity

Question 8

Refer to the exhibit. You are analyzing high severity alerts from Microsoft Defender for Endpoint in Microsoft Sentinel. What does this KQL query do?

Accepted Answer

It lists high severity Defender for Endpoint alerts, grouped by name and day, ordered by frequency. The KQL query uses `summarize` with `count()` to group alerts by `AlertName` and `startofday(TimeGenerated)`, then sorts by `count_` descending. This directly produces a list of high severity Defender for Endpoint alerts grouped by name and day, ordered by frequency, matching option C.

Answer

It counts alerts for a specific alert name

Answer

It displays detailed properties of each alert

Answer

It shows all alerts from Defender for Endpoint in the last week

Question 9

Refer to the exhibit. A security administrator runs this PowerShell script. What is the effect?

Accepted Answer

It creates an automation rule that runs a playbook on medium severity incidents. The PowerShell script uses the `New-AzSentinelAutomationRule` cmdlet to create an automation rule in Microsoft Sentinel. The `-TriggerType` parameter is set to `IncidentCreated`, and the `-Action` parameter specifies a playbook to run. The `-TriggeringLogic` parameter filters for incidents with a severity of `Medium`, so the automation rule triggers the playbook only when a medium-severity incident is created.

Answer

It creates a playbook that runs daily for high severity incidents

Answer

It schedules a daily report generation for all incidents

Answer

It creates a playbook named 'DailySummaryReport'

Question 10

You are a security analyst at a company that uses Microsoft Sentinel. You need to ensure that only users with a specific tag in Microsoft Entra ID can access the Sentinel workspace. Which Azure feature should you use?

Accepted Answer

Configure a Conditional Access policy in Microsoft Entra ID.. Conditional Access policies in Microsoft Entra ID can enforce access controls based on user attributes, including tags. By configuring a Conditional Access policy that grants access to Microsoft Sentinel only if the user has a specific tag, you can restrict workspace access at the authentication layer before any Azure RBAC evaluation occurs. This is the correct approach because Conditional Access operates at the identity level, directly controlling which users can authenticate to the Sentinel workspace.

Answer

Assign Azure RBAC roles with a condition on the tag.

Answer

Use Microsoft Entra Privileged Identity Management (PIM) to require approval for access.

Answer

Apply an Azure Policy to deny access if the user does not have the tag.

Question 11

Your organization uses Microsoft Defender XDR. You notice that automated investigations are being blocked for certain devices due to high-severity alerts. You need to ensure that automated actions can proceed for devices with a risk score below 30. What should you configure?

Accepted Answer

Configure a device group with an automated investigation and response rule that excludes devices with a risk score above 30.. Option A is correct because device groups in Microsoft Defender XDR allow you to scope automated investigation and response (AIR) rules based on device risk scores. By creating a device group that excludes devices with a risk score above 30, you ensure that automated actions proceed only for devices meeting your threshold, directly addressing the requirement.

Answer

Disable automated investigation for all devices and rely on manual investigation.

Answer

Adjust the Microsoft Defender for Cloud Apps policy to allow automated actions for low-risk devices.

Answer

Modify the attack surface reduction rules to allow automated actions on low-risk devices.

Question 12

You are configuring Microsoft Sentinel to ingest logs from a third-party firewall via Syslog. The data connector shows 'Connected' but no events are being received. You have verified network connectivity and firewall configuration. What should you check next?

Accepted Answer

Validate that the Data Collection Rule (DCR) is properly configured to ingest the Syslog facility and severity.. Option A is correct because when a Syslog data connector shows 'Connected' but no events are received, the most common cause is a misconfigured Data Collection Rule (DCR). The DCR defines which Syslog facilities and severities to collect; if it does not match the firewall's actual Syslog output (e.g., facility 'local0' with severity 'informational'), events will be filtered out before ingestion. Network connectivity and firewall configuration are already verified, so the DCR is the next logical check.

Answer

Verify that the connector has the necessary OAuth permissions in Microsoft Entra ID.

Answer

Check that the user who configured the connector has the Microsoft Sentinel Contributor role.

Answer

Ensure the firewall is registered in Azure Policy as a compliant resource.

Question 13

Your organization uses Microsoft Defender for Cloud to manage security posture. You need to assign a custom initiative to a specific management group to track compliance. Which two components must you create?

Accepted Answer

A policy definition and an initiative definition.. To track compliance for a custom initiative in Microsoft Defender for Cloud, you must first create a custom policy definition that specifies the rules or effects to enforce. Then, you must create an initiative definition (a group of policy definitions) that can be assigned to a management group. This assignment enables Defender for Cloud to evaluate resources against the custom initiative and report compliance.

Answer

An Azure Blueprint and a role assignment.

Answer

An Azure RBAC role and a Log Analytics workspace.

Answer

An Azure Monitor workbook and an alert rule.

Question 14

You are a security operations analyst at a company that uses Microsoft Sentinel. You have enabled User and Entity Behavior Analytics (UEBA) to detect anomalies. A new alert fires indicating a user is logging in from an unusual location. However, the user is a known traveler. How can you reduce false positives without disabling the UEBA rule?

Accepted Answer

Add the user to the entity behavior analytics exclusion list.. Option A is correct because Microsoft Sentinel's UEBA allows you to add specific users to an entity behavior analytics exclusion list. This prevents the UEBA engine from generating alerts for that user's anomalous activities, such as logins from unusual locations, without disabling the underlying detection rule. This approach maintains detection coverage for other users while suppressing false positives for known travelers.

Answer

Disable the UEBA anomaly rule for unusual locations.

Answer

Change the alert severity to Informational.

Answer

Increase the lookback period for the anomaly detection.

Question 15

You are reviewing an analytics rule in Microsoft Sentinel. The rule is supposed to alert when a Confidential sensitivity label file is accessed. However, no alerts have been generated despite known accesses. What is the most likely reason?

Accepted Answer

The required data connector for Microsoft Purview Information Protection is not connected.. Microsoft Sentinel relies on data connectors to ingest logs from external sources. For alerts based on sensitivity labels (e.g., Confidential), the required data source is Microsoft Purview Information Protection (formerly Azure Information Protection). If this connector is not connected, Sentinel has no way to receive the label-related events, so no alerts can be generated regardless of the rule logic.

Answer

The suppression duration is set to 5 hours, which suppresses alerts.

Answer

The query frequency and period are too short to capture the events.

Answer

The trigger condition is set to 'GreaterThan' 0, which should fire on any event.