SC-200 Manage a security operations environment Practice Test 15 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Office 365. You need to configure a policy that automatically moves emails containing malware to quarantine before delivery. Which policy type should you use?

Accepted Answer

Antimalware policy.. Antimalware policies in Microsoft Defender for Office 365 are specifically designed to scan inbound and outbound email messages for malware (e.g., viruses, worms, trojans) and automatically quarantine detected threats before delivery. This policy type uses the built-in malware detection engine to inspect attachments and message bodies, ensuring malicious content is blocked at the transport layer.

Answer

Anti-spam policy.

Answer

Safe Attachments policy.

Answer

Anti-phishing policy.

Question 2

You are managing Microsoft Defender for Cloud Apps. You discover that a user is downloading large amounts of data from a sanctioned cloud app. You need to automatically suspend the user's access when the download exceeds 5 GB in 10 minutes. What should you create?

Accepted Answer

An anomaly detection policy with a mass download detection template.. An anomaly detection policy in Microsoft Defender for Cloud Apps can detect unusual user behavior, such as mass file downloads, using predefined templates like 'Mass download by a single user'. This policy can be configured to trigger automatic governance actions, including suspending the user, when the download exceeds a threshold like 5 GB in 10 minutes. It directly addresses the need to automatically suspend access based on volume and time.

Answer

A session policy to block downloads.

Answer

An app connector for the cloud app.

Answer

A data loss prevention (DLP) policy in Microsoft Purview.

Question 3

Your organization uses Microsoft Sentinel with a workspace in the East US region. You have a playbook that runs an automation rule to create a support ticket in ServiceNow. The playbook fails intermittently with a timeout error. You have verified that the playbook's managed identity has the correct permissions. What should you check next?

Accepted Answer

Verify that the logic app's network connectivity allows outbound traffic to the ServiceNow endpoint, including any regional restrictions.. The playbook is a Logic App, and intermittent timeout errors when calling an external API (ServiceNow) often indicate network connectivity issues. Since the managed identity permissions are correct, the next logical step is to verify that the Logic App's outbound traffic is allowed to the ServiceNow endpoint, including any regional restrictions that might block or delay traffic from the East US region. This directly addresses the root cause of the timeout.

Answer

Ensure the playbook is assigned to an Azure Policy that allows outbound connections.

Answer

Check if the ServiceNow API has rate limits that are being exceeded.

Answer

Verify that the logic app's workflow is configured to use asynchronous operations.

Question 4

Which TWO permissions are required to configure a data connector in Microsoft Sentinel?

Accepted Answer

Log Analytics Contributor. To configure a data connector, you need Microsoft Sentinel Contributor to manage Sentinel resources and Log Analytics Contributor to manage the workspace. Option B and C are correct. Option A (Reader) is insufficient. Option D (Security Admin) is not a Sentinel-specific role. Option E (Global Admin) is not required.

Answer

Microsoft Sentinel Reader

Answer

Global Administrator

Answer

Security Admin

Question 5

Which THREE components are part of the Microsoft Defender XDR incident management process?

Accepted Answer

Entities. Entities are a core component of the Microsoft Defender XDR incident management process because they represent the assets (such as users, devices, mailboxes, and applications) that are involved in an incident. The incident graph automatically links related entities to provide a unified view of the attack story, enabling analysts to pivot from an alert to the affected resources for investigation and response.

Answer

User settings

Answer

Playbooks

Question 6

Which TWO actions can you perform using Microsoft Sentinel automation rules?

Accepted Answer

Change incident status. Automation rules in Microsoft Sentinel allow you to automatically manage incidents by changing their status (e.g., from 'New' to 'Active' or 'Closed') based on conditions like severity or title. They can also trigger playbooks (automated response workflows) when incidents are created or updated, enabling actions such as enrichment, investigation, or remediation. These capabilities are defined in the automation rule's 'Actions' section, where you set the incident status or select a playbook to run.

Answer

Create a new analytics rule

Answer

Modify a data connector

Answer

Delete an incident

Question 7

Which THREE conditions can you use to trigger a Microsoft Sentinel scheduled analytics rule?

Accepted Answer

Custom threshold on a specific field. Option A is correct because Microsoft Sentinel scheduled analytics rules allow you to set a custom threshold on a specific field within the query results. This condition triggers an alert when the aggregated value of that field (e.g., count, sum, or average) meets or exceeds the defined threshold, enabling precise detection of anomalies like excessive failed logins from a single user.

Answer

Query results include a specific IP address

Answer

Time since last alert for a given entity exceeds a value

Question 8

You are a security analyst for a multinational company with Microsoft Sentinel deployed in a central workspace. You need to grant a team of analysts in the European branch the ability to view incidents and run queries, but they should not be able to modify analytics rules or data connectors. The team already has Microsoft Sentinel Reader role assigned. However, they report that they cannot run KQL queries in the Logs blade. You need to provide the minimum additional permissions. What should you do?

Accepted Answer

Assign the Log Analytics Reader role to the team on the Sentinel workspace.. The Microsoft Sentinel Reader role grants read access to Sentinel data, including incidents, but does not include the ability to run KQL queries in the Logs blade because that requires read permissions on the underlying Log Analytics workspace. The Log Analytics Reader role provides the necessary read access to log data and the ability to execute queries without granting write permissions to analytics rules or data connectors, fulfilling the requirement with minimal privileges.

Answer

Assign the Log Analytics Contributor role to the team on the Sentinel workspace.

Answer

Assign the Microsoft Sentinel Contributor role to the team on the Sentinel workspace.

Answer

Assign the Reader role to the team on the Sentinel workspace.

Question 9

You are a security operations analyst at a company that uses Microsoft Defender XDR and Microsoft Sentinel. You have configured a custom detection rule in Microsoft Defender XDR that uses a KQL query to detect suspicious PowerShell activity. The rule triggers an alert, but you want to automatically create an incident in Microsoft Sentinel and run a playbook that isolates the affected device. You have already set up the Microsoft Defender XDR connector in Sentinel and enabled incident creation from Defender XDR alerts. However, the playbook does not run automatically when a Defender XDR incident is created. You have verified that the playbook is properly configured and has the correct permissions. What should you do?

Accepted Answer

Create an automation rule in Microsoft Sentinel that triggers on incident creation and runs the playbook.. To automate playbook execution on incidents from Defender XDR, you need to create an automation rule in Microsoft Sentinel that triggers when an incident is created and then runs the playbook. Option D is correct. Option A (modify Defender XDR connector) does not include playbook execution. Option B (create automation rule in Defender XDR) is not possible; Defender XDR does not have automation rules for playbooks. Option C (modify the custom detection rule) does not trigger playbooks.

Answer

Create an automation rule in Microsoft Defender XDR to run the playbook.

Answer

Modify the Microsoft Defender XDR data connector in Sentinel to enable playbook execution.

Answer

Modify the custom detection rule in Defender XDR to include a 'run playbook' action.

Question 10

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. The security team wants to automatically create an incident in Microsoft Sentinel when a Microsoft Defender for Endpoint alert is triggered. What should you configure?

Accepted Answer

Enable the Microsoft Defender XDR connector in Microsoft Sentinel and select the incident creation settings.. Option A is correct because the Microsoft Defender XDR connector in Microsoft Sentinel is specifically designed to ingest alerts and incidents from Microsoft Defender for Endpoint and other Defender products. By enabling this connector and configuring its incident creation settings, Sentinel automatically creates incidents when Defender for Endpoint alerts are triggered, without requiring custom logic or manual polling.

Answer

Set up a Logic App custom connector to poll Defender alerts.

Answer

Configure the Security Events connector to forward Defender alerts.

Answer

Create analytics rules in Microsoft Sentinel for each Defender alert type.

Question 11

Your security operations team uses Microsoft Sentinel workbooks to monitor security posture. You notice that a workbook query is timing out when run against a large workspace. What is the best way to optimize the query without changing its results?

Accepted Answer

Use the workspace() function to query specific workspaces only.. Option C is correct because the `workspace()` function in KQL allows you to explicitly scope a query to specific workspaces, reducing the data scanned and improving performance. By targeting only the necessary workspaces, you avoid the overhead of querying the entire large workspace, which is the root cause of the timeout. This optimization does not alter the query logic or results, as it simply restricts the data source.

Answer

Remove some filter conditions to simplify the query.

Answer

Add a summarize operator at the end of the query.

Answer

Reduce the time range of the query.

Question 12

Your organization is implementing Microsoft Sentinel in a multi-tenant environment using Azure Lighthouse. The SOC team needs to investigate incidents across all tenants from a single interface. Which configuration is required?

Accepted Answer

Onboard multiple workspaces to Azure Lighthouse and use a central workspace for investigation.. Option D is correct because Azure Lighthouse enables cross-tenant management by allowing the SOC team to delegate access to multiple Sentinel workspaces from a single control plane. This configuration lets investigators view and manage incidents across all tenants without needing separate sign-ins or duplicating data, which is essential for a multi-tenant SOC environment.

Answer

Use Azure AD B2B to grant users from other tenants access to the workspace.

Answer

Create a single workspace and have all tenants send logs to it.

Answer

Assign custom roles in each tenant's Sentinel workspace.

Question 13

Your organization has Microsoft Defender for Cloud Apps (MDA) connected to Microsoft Sentinel. The SOC team wants to receive alerts when a user accesses a sanctioned cloud app from an anonymous IP address. What should you configure?

Accepted Answer

Create an activity policy in Defender for Cloud Apps and connect it to Sentinel.. Option B is correct because an activity policy in Defender for Cloud Apps can be configured to trigger alerts on specific user activities, such as accessing a sanctioned app from an anonymous IP address. This policy can then be connected to Microsoft Sentinel via the Defender for Cloud Apps data connector, which ingests alerts as incidents for SOC review. File policies (A) focus on file-level actions like sharing or malware detection, not user access events, while session policies (D) control real-time access but do not generate alerts for historical or post-access monitoring.

Answer

Create a file policy in Defender for Cloud Apps.

Answer

Enable the Defender for Cloud Apps connector in Sentinel without additional configuration.

Answer

Create a session policy in Defender for Cloud Apps.

Question 14

Your Microsoft Sentinel workspace is experiencing high ingestion costs. Which of the following actions will most effectively reduce costs while maintaining security visibility?

Accepted Answer

Configure Basic Logs for verbose logs like Windows events from non-critical servers.. Option B is correct because configuring Basic Logs for verbose logs (e.g., Windows Event ID 4688 from non-critical servers) reduces ingestion costs by storing them in a lower-cost tier while still retaining them for security investigations. Basic Logs are charged at a lower ingestion rate and support simple queries and search jobs, preserving visibility for incident response without the full cost of Analytics Logs.

Answer

Delete unused analytics rules to reduce log ingestion.

Answer

Disable collection of all informational logs.

Answer

Reduce the data retention period to 30 days.

Question 15

Your organization uses Microsoft Sentinel with UEBA (User and Entity Behavior Analytics) enabled. The SOC team notices that UEBA is not generating any anomalies for a specific user group. What is the most likely cause?

Accepted Answer

The data history for that user group is less than the required baseline period.. Option C is correct because UEBA requires a baseline of at least 21 days. Option A is wrong because UEBA uses its own machine learning, not analytics rules. Option B is wrong because UEBA works with any data connector that provides user activity. Option D is wrong because Identity Protection is for Azure AD, not for UEBA anomalies.

Answer

The user group is excluded from Identity Protection.

Answer

The user group is not being monitored by any data connector.

Answer

The analytics rules for UEBA are not enabled.