SC-200 Manage a security operations environment Practice Test 15 — 15 Questions

Question 1

Refer to the exhibit. You are reviewing an Azure Resource Manager (ARM) template for a Microsoft Sentinel analytics rule. Based on the exhibit, which statement is true?

Accepted Answer

The rule will generate one alert per user that has MFA disabled.. The ARM template configures a Microsoft Sentinel scheduled analytics rule that runs every hour, queries for users with MFA disabled, and uses the 'Alert Per Result' event grouping setting. This setting generates a separate alert for each unique result returned by the query, meaning each user who has MFA disabled triggers its own alert.

Answer

The rule will create one incident per alert and group alerts by entity.

Answer

The rule will only trigger if more than 5 users have MFA disabled.

Answer

The rule runs every hour and looks back 5 hours.

Question 2

Your organization, Contoso, uses Microsoft Sentinel in a single Log Analytics workspace. You have ingested logs from Microsoft Defender XDR, Microsoft Entra ID, and Azure Firewall. The SOC team needs to investigate an incident where a user's account was compromised and used to access sensitive data from an external IP address. The incident was created from a Microsoft Defender for Cloud Apps alert. The SOC team wants to automatically block the user from further access and disable the user account in Microsoft Entra ID. You need to design an automated response using Microsoft Sentinel playbooks. The solution must minimize manual intervention. You have the following options: A) Create a playbook that triggers on the incident and uses the Microsoft Graph API to disable the user account and revoke sessions. Configure the playbook to run automatically from an automation rule. B) Create a playbook that triggers on the alert and uses the Defender for Cloud Apps API to suspend the user. Configure the automation rule to run the playbook on incident creation. C) Create a playbook that sends an email to the SOC team to manually disable the user. D) Create an automation rule that automatically changes the incident status to 'Active' and assigns it to a senior analyst. Which option should you choose?

Accepted Answer

Create a playbook that triggers on the incident and uses the Microsoft Graph API to disable the user account and revoke sessions. Configure the playbook to run automatically from an automation rule.. It uses a playbook triggered on incident creation and leverages the Microsoft Graph API to disable the user account and revoke sessions, which directly addresses the compromised account in Microsoft Entra ID. This approach minimizes manual intervention by automating the entire response within Microsoft Sentinel, aligning with the requirement to block further access and disable the account automatically.

Answer

Create an automation rule that automatically changes the incident status to 'Active' and assigns it to a senior analyst.

Answer

Create a playbook that sends an email to the SOC team to manually disable the user.

Answer

Create a playbook that triggers on the alert and uses the Defender for Cloud Apps API to suspend the user. Configure the automation rule to run the playbook on incident creation.

Question 3

Your organization, Fabrikam, has a hybrid environment with on-premises Active Directory and Microsoft Entra ID. You are using Microsoft Sentinel and Microsoft Defender XDR. You have enabled Microsoft Defender for Identity (MDI) to protect on-premises Active Directory. Recently, you received an incident in Microsoft Sentinel indicating a potential DCSync attack from a domain controller. The incident was generated from an MDI alert. You need to investigate the incident and determine if the attack was successful. You have the following options: A) Use the Microsoft Sentinel incident investigation graph to view entities and relationships. Then query the IdentityDirectoryEvents table for the domain controller to see if any directory replication requests were made. B) Use the Microsoft Defender XDR advanced hunting to query the IdentityLogonEvents table for the domain controller. C) Use the Microsoft Sentinel workbook for MDI to visualize the attack timeline. D) Use the Microsoft Defender for Cloud Apps activity log to review the domain controller's activities. Which option should you choose?

Accepted Answer

Use the Microsoft Sentinel incident investigation graph to view entities and relationships. Then query the IdentityDirectoryEvents table for the domain controller to see if any directory replication requests were made.. A DCSync attack involves an attacker impersonating a domain controller to request directory replication via the MS-DRSR protocol. The IdentityDirectoryEvents table in Microsoft Defender for Identity captures directory service replication activities, including the DirectoryReplication request action. Querying this table for the domain controller allows you to confirm if unauthorized replication requests were made, directly indicating a successful DCSync attack.

Answer

Use the Microsoft Sentinel workbook for MDI to visualize the attack timeline.

Answer

Use the Microsoft Defender XDR advanced hunting to query the IdentityLogonEvents table for the domain controller.

Answer

Use the Microsoft Defender for Cloud Apps activity log to review the domain controller's activities.

Question 4

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to ensure that an external user from a partner organization can access a specific Sentinel workbook without having access to the entire Log Analytics workspace. What should you do?

Accepted Answer

Use Azure AD B2B collaboration to invite the external user and assign the Sentinel Reader role on the workbook.. Azure AD B2B collaboration allows you to invite an external user from a partner organization into your Azure AD tenant. By assigning the Sentinel Reader role specifically on the workbook resource (not the workspace), the user can view the workbook without gaining access to the underlying Log Analytics workspace data or other Sentinel resources. This meets the requirement of granular, scoped access.

Answer

Create a new Log Analytics workspace dedicated to the external partner and deploy the workbook there.

Answer

Share the workbook as a shared dashboard in the Azure portal.

Answer

Add the external user to the resource group containing the workspace with Reader role.

Question 5

Refer to the exhibit. An automation rule in Microsoft Sentinel is configured as shown. When a high-severity incident is created, what is the expected behavior?

Accepted Answer

The task is created, then the playbook runs, but the incident modification fails because the owner is incorrectly formatted.. The automation rule in Microsoft Sentinel executes actions sequentially. The task creation and playbook run succeed, but the incident modification fails because the owner field is incorrectly formatted. Sentinel expects the incident owner to be specified as a user principal name (UPN) or object ID, not a plain text string like 'SOC-Tier1'.

Answer

All actions execute successfully: task created, playbook runs, incident owner set to SOC-Tier1.

Answer

The rule fails to run because the actions are not in valid JSON format.

Answer

The playbook runs first, then the task is created, then the incident is modified.

Question 6

Your organization wants to use Microsoft Copilot for Security to generate incident summaries. What is the minimum license required?

Accepted Answer

Microsoft Copilot for Security standalone or add-on. Microsoft Copilot for Security is a standalone product that can be licensed independently or as an add-on to existing security subscriptions. It is not included in any Microsoft 365 or Defender plan by default; therefore, the minimum license required is either the standalone Copilot for Security SKU or the add-on license. This ensures the organization has the necessary entitlements to generate incident summaries using Copilot for Security.

Answer

Microsoft 365 E5

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Office 365 P2

Question 7

Your organization uses Microsoft Sentinel. You need to configure a playbook that automatically responds to incidents by creating a support ticket in ServiceNow. Which connector should you use?

Accepted Answer

ServiceNow connector. The ServiceNow connector is the correct choice because it provides a direct, pre-built integration between Microsoft Sentinel and ServiceNow, enabling automated creation of incidents or tickets in ServiceNow when a Sentinel incident is triggered. This connector uses the ServiceNow REST API to map Sentinel fields to ServiceNow ticket fields, eliminating the need for custom HTTP calls or additional middleware.

Answer

HTTP connector

Answer

Azure Monitor connector

Answer

Office 365 Outlook connector

Question 8

Refer to the exhibit. A KQL query is used in a Microsoft Sentinel scheduled analytics rule to detect unhealthy agents. The rule runs every 5 minutes and has a lookback period of 5 minutes. What is the potential issue?

Accepted Answer

The query may miss agents with no heartbeat in the last 5 minutes due to the lookback period matching the run frequency.. The rule runs every 5 minutes with a 5-minute lookback, creating a gap: if an agent sends a heartbeat at 0:01 and the rule runs at 0:05, the heartbeat falls within the lookback window. However, if the agent misses a heartbeat cycle (e.g., heartbeat interval is 10 minutes), the rule may not detect the absence because the lookback window only covers the last 5 minutes, and the last heartbeat might be older than 5 minutes. This means agents with no heartbeat in the last 5 minutes could be missed, especially if the heartbeat interval is longer than the lookback period.

Answer

The query will return all computers as unhealthy because the threshold is too high.

Answer

The query will not return any results because Heartbeat data is not in the workspace.

Answer

The query will cause a runtime error because ago() is misused.

Question 9

Your organization uses Microsoft Defender for Cloud. You need to view a list of all security recommendations for your Azure subscriptions. Which blade should you use?

Accepted Answer

Recommendations. The Recommendations blade in Microsoft Defender for Cloud is the centralized hub that lists all security recommendations for your Azure subscriptions, including those from Azure Security Benchmark and custom initiatives. It provides a prioritized view of security posture improvements, such as remediating vulnerabilities or enabling encryption, directly actionable from the blade.

Answer

Workbooks

Answer

Regulatory Compliance

Answer

Inventory

Question 10

Your organization uses Microsoft Defender XDR. You want to ensure that all incidents with severity 'High' are automatically assigned to the 'Tier1' group and have a playbook executed. What should you use?

Accepted Answer

Automation rules in Microsoft Sentinel. Automation rules in Microsoft Sentinel allow you to automatically assign incidents to a specific group (e.g., 'Tier1') and trigger a playbook based on incident properties such as severity. This directly meets the requirement to assign 'High' severity incidents to the 'Tier1' group and execute a playbook without manual intervention.

Answer

Microsoft Defender XDR incident assignment manually by analysts

Answer

Custom analytics rules in Microsoft Sentinel

Answer

Playbooks in Microsoft Sentinel

Question 11

Your organization has deployed Microsoft Sentinel in multiple regions. You need to ensure that incidents created in one workspace are available for correlation in a central workspace. What should you implement?

Accepted Answer

Sentinel workspace manager (incident replication). Sentinel Workspace Manager (incident replication) is the correct choice because it provides native, built-in replication of incidents from multiple workspaces to a central workspace without requiring custom code or external automation. This feature ensures that incidents created in regional workspaces are automatically synchronized to a designated central workspace, enabling unified correlation and investigation across regions.

Answer

Cross-workspace queries in KQL

Answer

Automated export of incidents to central workspace using Logic Apps

Answer

Azure Lighthouse

Question 12

Your organization uses Microsoft Defender for Identity. You need to create a role that allows analysts to view security alerts but not modify them. Which built-in role should you assign?

Accepted Answer

Security Reader. The Security Reader role (D) is the correct choice because it provides read-only access to security-related features in Microsoft 365 Defender, including the ability to view security alerts from Microsoft Defender for Identity without the ability to modify or respond to them. This aligns directly with the requirement to allow analysts to view alerts but not modify them, as the role grants no write permissions to security configurations or alert states.

Answer

Security Administrator

Answer

Compliance Administrator

Answer

Global Administrator

Question 13

Which THREE are valid ways to ingest data into Microsoft Sentinel? (Select three.)

Accepted Answer

Configuring Syslog using Azure Monitor Agent (AMA). The Azure Monitor Agent (AMA) can collect Syslog events from Linux-based sources and forward them to a Log Analytics workspace, which is the underlying data store for Microsoft Sentinel. By configuring a Data Collection Rule (DCR) that specifies the Syslog facility and severity levels, AMA streams these logs into the Syslog table in the workspace, making them available for detection and analysis within Sentinel.

Answer

Connecting to Azure DevOps directly

Answer

Importing from Power BI datasets

Question 14

Which TWO roles in Microsoft Entra ID can manage Microsoft Defender for Cloud Apps? (Select two.)

Accepted Answer

Security Administrator. The Security Administrator role in Microsoft Entra ID has the necessary permissions to manage Microsoft Defender for Cloud Apps, including configuring policies, investigating alerts, and managing app permissions. This role is specifically designed for security-related tasks within Microsoft 365 security products, making it a correct choice for managing Defender for Cloud Apps.

Answer

Compliance Administrator

Answer

Security Reader

Answer

Application Administrator

Question 15

You are a SOC analyst at Contoso. The environment includes Microsoft Sentinel in a single workspace, Microsoft Defender XDR (including Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps), Microsoft Entra ID, and Microsoft Intune. You need to design a solution to automatically triage and respond to phishing incidents detected by Defender for Office 365. The requirements are: 1) When a phishing alert is generated with high confidence, an incident should be automatically created in Sentinel. 2) The incident should be assigned to the 'Phishing' team and have a severity of High. 3) A playbook should run that will send a Teams message to the Phishing team and also block the sender in Exchange Online. 4) The incident should be automatically closed if the playbook successfully executes. What should you do?

Accepted Answer

Enable the Microsoft 365 Defender connector to synchronize incidents, create an automation rule triggered on incident creation with conditions for 'Phishing' and high confidence, assigning to 'Phishing' team, running a playbook, and enabling auto-closure.. It leverages the Microsoft 365 Defender connector to synchronize incidents from Defender for Office 365 into Microsoft Sentinel, which is the recommended approach for ingesting high-confidence phishing alerts. An automation rule triggered on incident creation with conditions for 'Phishing' and high confidence can assign the incident to the 'Phishing' team, run a playbook to send a Teams message and block the sender in Exchange Online, and enable auto-closure upon successful playbook execution.

Answer

Use the Office 365 connector to ingest alerts, then create an analytics rule to generate incidents, and use automation rules to assign and run playbooks.

Answer

Use a Logic App to continuously poll Defender for Office 365 APIs for alerts, create incidents via the Sentinel API, and assign them.

Answer

Create a custom analytics rule with KQL to detect phishing in Defender for Office 365 logs, generate incidents, and use automation rules.