SC-200 Manage a security operations environment Practice Test 15 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel with Azure Monitor Agent (AMA) to collect Windows security events. You need to collect process creation events (Event ID 4688) and include command-line information. The current Data Collection Rule (DCR) collects only basic security events. What should you modify?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable the 'Include command line in process creation events' policy in Windows Group Policy.. Event ID 4688 (process creation) can include command-line arguments, but this data is not captured by default. The 'Include command line in process creation events' Group Policy setting must be enabled on the Windows machines to populate the CommandLine field in the security event log. Without this policy, the AMA and DCR will collect the event but the command-line information will be empty.

Answer

Upgrade the AMA to the latest version.

Answer

Modify the DCR to include Event ID 4688 in the data source.

Answer

Switch to the Windows Security Events via Legacy Agent connector.

Question 2

You are configuring automated responses in Microsoft Sentinel. You have created an automation rule that runs a playbook when an incident is created. The playbook performs actions in Microsoft Entra ID and Microsoft Defender for Cloud. However, the playbook fails with a permissions error. What should you do?

Accepted Answer

Assign the managed identity of the playbook the required roles in Microsoft Entra ID and Defender for Cloud.. The playbook fails with a permissions error because it uses a managed identity to authenticate to Microsoft Entra ID and Microsoft Defender for Cloud, but that identity has not been granted the necessary Azure RBAC roles (e.g., Security Reader, Security Admin) on the target resources. Assigning the required roles to the managed identity directly resolves the authorization failure.

Answer

Enable 'Allow playbooks to use managed identity' in the Sentinel settings.

Answer

Configure the Microsoft Entra ID connector in Sentinel with delegated permissions.

Answer

Grant the security analyst's account Contributor permissions on the automation rule.

Question 3

You need to ensure that critical incidents in Microsoft Sentinel are automatically assigned to a senior security analyst. What should you configure?

Accepted Answer

Create an automation rule that assigns the incident to the analyst.. Automation rules in Microsoft Sentinel allow you to automatically assign incidents to specific users or groups based on conditions like severity or title. By creating an automation rule that triggers on incident creation and sets the owner to the senior security analyst, you ensure critical incidents are assigned without manual intervention.

Answer

Create an analytics rule with a custom schedule.

Answer

Configure a workbook to filter incidents by owner.

Answer

Add the analyst to a watchlist used in analytics rules.

Question 4

Which TWO actions should you take to reduce the cost of Microsoft Sentinel while maintaining security coverage?

Accepted Answer

Reduce the retention period of tables that do not require long-term storage.. Reducing the retention period for tables that do not require long-term storage directly lowers the data storage costs in Microsoft Sentinel. Sentinel charges per GB of data stored, and by shortening retention (e.g., from 90 days to 30 days) for non-critical tables, you reduce the volume of data retained without affecting security monitoring or incident investigation for the shortened period.

Answer

Remove data connectors for non-critical sources.

Answer

Disable analytics rules that generate low-severity incidents.

Answer

Switch the workspace pricing tier from Capacity Reservations to Pay-as-you-Go.

Question 5

Which THREE components are required to collect syslog messages from a network appliance into Microsoft Sentinel using the Azure Monitor Agent?

Accepted Answer

A syslog daemon (e.g., rsyslog) on the log collector server to receive messages.. Syslog messages are sent over UDP (or TCP) by network appliances, and a syslog daemon like rsyslog must be running on the log collector server to listen on port 514 (or a custom port) and receive those messages. Without this daemon, the Azure Monitor Agent cannot ingest the raw syslog data, as the agent relies on the local syslog daemon to capture and forward the logs to its event pipeline.

Answer

The Log Analytics agent (MMA) installed on the appliance.

Answer

The Syslog data connector in Microsoft Sentinel.

Question 6

Refer to the exhibit. You have an automation rule defined as shown. The rule is enabled but never triggers. What is the most likely reason?

Accepted Answer

The condition requires incident status 'Active', but incidents start as 'New'.. The automation rule triggers on incident creation, but the condition requires the incident status to be 'Active'. In Microsoft Sentinel, incidents are created with a status of 'New', not 'Active'. Therefore, the condition is never met, and the rule never triggers. To fix this, the condition should either be removed or changed to include 'New' status.

Answer

The playbook resource ID is incomplete.

Answer

The trigger type should be 'AlertCreated' instead of 'IncidentCreated'.

Answer

The rule order is set to 1, which is too low.

Question 7

Refer to the exhibit. You deploy this ARM template to your subscription. After deployment, you cannot find the saved search 'Test Search' in the Microsoft Sentinel workspace. What is the most likely reason?

Accepted Answer

The resource type should be for analytics rules, not saved searches.. The ARM template deploys a resource of type 'Microsoft.OperationsManagement/solutions' with a saved search, but Microsoft Sentinel does not use saved searches for analytics rules. In Sentinel, detection rules are created as 'Microsoft.SecurityInsights/alertRules', not as saved searches under a Log Analytics workspace. The template's resource type is mismatched for the intended functionality, so the saved search 'Test Search' will not appear as a Sentinel analytics rule.

Answer

The query 'Heartbeat | summarize Count() by Computer' is invalid.

Answer

The apiVersion is incorrect.

Answer

The name concatenation is missing a parameter.

Question 8

Your security team is investigating an incident in Microsoft Defender XDR where a user received multiple phishing emails. The team needs to create an automated response that blocks the sender's email address across all mailboxes in the organization. Which action should you configure in an automated investigation and response (AIR) playbook?

Accepted Answer

Add a 'Block sender' action in Microsoft Defender for Office 365.. Blocking a sender's email address across all mailboxes is a native capability of Microsoft Defender for Office 365. The 'Block sender' action in an AIR playbook directly adds the sender to the tenant's block list, which is enforced at the transport layer for all inbound email, effectively preventing any further delivery from that address.

Answer

Add a 'Block IP address' action in Microsoft Defender for Cloud Apps.

Answer

Create a custom detection rule in Microsoft Sentinel.

Answer

Deploy a configuration profile in Microsoft Intune.

Question 9

You are configuring a Microsoft Sentinel analytics rule to detect failed logons from multiple IP addresses. The rule should trigger an incident only when the same user account has failed logons from more than three distinct IP addresses within 5 minutes. Which rule setting should you configure?

Accepted Answer

Set the 'Alert threshold' to 'Custom' and define a condition on distinct IP count.. The requirement is to trigger an incident only when the same user account has failed logons from more than three distinct IP addresses within 5 minutes. In Microsoft Sentinel analytics rules, the 'Alert threshold' set to 'Custom' allows you to define a condition on the count of distinct values (e.g., distinct IP addresses) aggregated over the rule's query window, which directly matches the scenario.

Answer

Set the 'Group by' field to 'Account' and 'IP address'.

Answer

Set the 'Event grouping' to 'Group all events into a single alert'.

Answer

Set the 'Suppression' to '5 minutes' after an alert is generated.

Question 10

Your organization uses Microsoft Defender XDR and has a custom detection rule that queries DeviceProcessEvents for suspicious PowerShell commands. You notice that the rule is generating a high number of false positives. You need to reduce false positives while still detecting real threats. What should you do?

Accepted Answer

Add a condition to exclude processes signed by trusted certificates or from known IT admin accounts.. Adding a condition to exclude processes signed by trusted certificates or from known IT admin accounts directly reduces false positives by filtering out legitimate administrative activity. Custom detection rules in Microsoft Defender XDR allow you to refine queries with additional conditions, such as excluding specific signers or accounts, which preserves detection of malicious PowerShell commands while ignoring benign ones.

Answer

Disable the rule and create a new rule with a different MITRE technique.

Answer

Increase the lookback period from 7 to 30 days.

Answer

Modify the rule to set the severity to 'Informational'.

Question 11

Your team uses Microsoft Sentinel to monitor Azure subscriptions. You need to ensure that only users with the 'Microsoft Sentinel Contributor' role can create and edit analytics rules. You want to enforce this using Azure Policy. What should you do?

Accepted Answer

Create an Azure Policy that denies creation of analytics rules if the user doesn't have the 'Microsoft Sentinel Contributor' role.. Azure Policy can enforce guardrails by denying resource creation or modification based on conditions, such as the user's role. By creating a policy that denies the creation or editing of analytics rules unless the user has the 'Microsoft Sentinel Contributor' role, you directly enforce the requirement. This approach uses Azure Policy's 'deny' effect to prevent unauthorized actions at the Azure Resource Manager level, regardless of other permissions.

Answer

Use Azure Blueprints to assign the 'Microsoft Sentinel Contributor' role to a security group.

Answer

Assign the 'Microsoft Sentinel Contributor' role to all users at the subscription level.

Answer

Create a custom role that denies write access to analytics rules.

Question 12

You are setting up Microsoft Sentinel for the first time. You need to ingest Windows security events from on-premises servers using the Azure Monitor Agent. Which data connector should you enable in Microsoft Sentinel?

Accepted Answer

Windows Security Events via AMA. The Windows Security Events via AMA data connector is specifically designed to collect Windows security events (e.g., Event ID 4625, 4688) from on-premises servers using the Azure Monitor Agent (AMA). This connector leverages the AMA's Data Collection Rules (DCRs) to filter and ingest security-relevant logs directly into Microsoft Sentinel, making it the correct choice for this scenario.

Answer

Common Event Format (CEF) via AMA

Answer

Syslog via AMA

Answer

DNS via AMA

Question 13

You are configuring Microsoft Sentinel to send email notifications to the security team when high-severity incidents are created. Which feature should you use?

Accepted Answer

Automation rule. Automation rules in Microsoft Sentinel allow you to define automated responses to incidents, including sending email notifications to specified recipients when incidents meet certain criteria, such as high severity. This feature directly supports the requirement to notify the security team when high-severity incidents are created, without requiring additional logic or manual steps.

Answer

Watchlist

Answer

Analytics rule

Answer

Workbook

Question 14

Your organization uses Microsoft Defender for Cloud Apps to monitor SaaS applications. You discover that a user is downloading a large number of files from SharePoint Online to an unmanaged device. You need to automatically block the download and require the user to acknowledge a policy violation. Which action should you configure in a session policy?

Accepted Answer

Set the action to 'Block' and enable 'Notify user' with a customized message.. A session policy in Microsoft Defender for Cloud Apps can enforce real-time controls on SaaS app traffic. Setting the action to 'Block' stops the download immediately, and enabling 'Notify user' with a customized message both blocks the action and requires the user to acknowledge the policy violation, satisfying the requirement to automatically block and obtain acknowledgment.

Answer

Set the action to 'Monitor only'.

Answer

Set the action to 'Redirect to Microsoft Entra ID conditional access'.

Answer

Set the action to 'Block' and enable 'Custom block message'.

Question 15

Which TWO actions are valid ways to integrate on-premises firewall logs into Microsoft Sentinel for analysis?

Accepted Answer

Configure the firewall to send Common Event Format (CEF) logs to a syslog server running Azure Monitor Agent.. On-premises firewall logs can be forwarded in Common Event Format (CEF) over syslog to a server running the Azure Monitor Agent (AMA), which then ingests them into Microsoft Sentinel. CEF is a standard log format supported by many security appliances, and the AMA replaces the older Log Analytics Agent for this purpose. This setup allows Sentinel to parse and analyze the firewall events for security monitoring.

Answer

Enable the Office 365 connector.

Answer

Install the Windows DNS Server connector.

Answer

Connect the Azure Activity log connector.