SC-200 Manage a security operations environment Practice Test 16 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Office 365. You want to automatically isolate a user's mailbox if a high-confidence phishing email is detected. Which Microsoft Sentinel automation should you use?

Accepted Answer

Create a playbook that uses the Microsoft Graph API to apply a mailbox litigation hold or block access.. Option B is correct because Microsoft Sentinel playbooks, built on Azure Logic Apps, can use the Microsoft Graph API to perform automated remediation actions like applying a mailbox litigation hold or blocking user access. This enables automatic isolation of a user's mailbox when a high-confidence phishing email is detected, which is a key incident response capability in Defender for Office 365.

Answer

Configure a workbook to display the alert and manually isolate the mailbox.

Answer

Enable the Office 365 connector and configure automatic response in the data connector.

Answer

Create a scheduled analytics rule that isolates the mailbox when triggered.

Question 2

Your SOC team uses Microsoft Sentinel incident management. They want to automatically assign high-severity incidents to a senior analyst and send a notification to Microsoft Teams. What should you use?

Accepted Answer

Create an automation rule that triggers on incident creation, assigns the incident, and runs a playbook to post to Teams.. Option A is correct because automation rules in Microsoft Sentinel can trigger on incident creation (e.g., when severity is 'High'), automatically assign the incident to a specific owner (senior analyst), and then invoke a playbook (Azure Logic App) to post a message to Microsoft Teams. This combines assignment logic with automated notification in a single, manageable rule.

Answer

Create a playbook and attach it directly to the analytics rule.

Answer

Create a watchlist to define assignment rules and configure a workbook for notifications.

Answer

Create an analytics rule with incident grouping and assignment.

Question 3

Your organization is migrating to Microsoft Sentinel. You need to ensure that the workspace retains data for 2 years for compliance, but you want to reduce costs by using cheaper storage for data older than 90 days. What should you configure?

Accepted Answer

Set workspace retention to 90 days and configure long-term retention in Azure Data Explorer (ADX).. Option B is correct because Microsoft Sentinel allows you to set the workspace retention to 90 days for interactive, hot-tier access, and then configure long-term retention in Azure Data Explorer (ADX) for data older than 90 days. This approach meets the 2-year compliance requirement while reducing costs, as ADX provides cheaper storage for older data that is queried less frequently.

Answer

Set the workspace retention to 730 days and enable a data cap.

Answer

Export data older than 90 days to a storage account and delete from workspace.

Answer

Configure the workspace retention to 90 days and use Azure Storage archiving.

Question 4

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. The SOC team needs to investigate a cross-tenant incident. Which TWO actions should you take? (Choose two.)

Accepted Answer

Use the Microsoft Defender XDR unified incident queue to view incidents across tenants.. Option A is correct because the Microsoft Defender XDR unified incident queue can display incidents from multiple tenants when properly configured, enabling cross-tenant investigation without additional licensing. This feature leverages Azure Lighthouse delegated access to aggregate alerts and incidents across tenants into a single view, streamlining SOC workflows.

Answer

Install the Microsoft Sentinel solution for each tenant separately.

Answer

Create a workspace query using the union operator to combine data from all tenants.

Question 5

Your organization uses Microsoft Sentinel and Microsoft Copilot for Security. You want to improve incident response efficiency. Which THREE features should you implement? (Choose three.)

Accepted Answer

Enable Microsoft Copilot for Security to assist with incident investigations.. Option A is correct because Microsoft Copilot for Security integrates directly with Microsoft Sentinel to provide AI-driven natural language assistance for incident investigations, enabling analysts to query data, summarize incidents, and generate KQL queries without manual scripting. This directly improves incident response efficiency by reducing investigation time and cognitive load.

Answer

Use watchlists to track known malicious IP addresses.

Answer

Configure workbooks to display real-time incident trends.

Question 6

Your organization plans to implement Microsoft Sentinel. Which THREE components are required for a basic deployment? (Choose three.)

Accepted Answer

Analytics rules to generate incidents.. Analytics rules are required to generate incidents from the data ingested into Microsoft Sentinel. Without analytics rules, the raw log data remains unprocessed and no security incidents are created, making the deployment non-functional for detection and response.

Answer

User and Entity Behavior Analytics (UEBA) enabled.

Answer

Bookmarks for incident investigations.

Question 7

Refer to the exhibit. You are reviewing an Azure Resource Manager (ARM) template for a Microsoft Sentinel analytics rule. Based on the exhibit, which statement is true?

Accepted Answer

The rule will generate one alert per user that has MFA disabled.. Option D is correct because the ARM template configures a Microsoft Sentinel scheduled analytics rule that runs every hour, queries for users with MFA disabled, and uses the 'Alert Per Result' event grouping setting. This setting generates a separate alert for each unique result returned by the query, meaning each user who has MFA disabled triggers its own alert.

Answer

The rule will create one incident per alert and group alerts by entity.

Answer

The rule will only trigger if more than 5 users have MFA disabled.

Answer

The rule runs every hour and looks back 5 hours.

Question 8

Your organization, Contoso, uses Microsoft Sentinel in a single Log Analytics workspace. You have ingested logs from Microsoft Defender XDR, Microsoft Entra ID, and Azure Firewall. The SOC team needs to investigate an incident where a user's account was compromised and used to access sensitive data from an external IP address. The incident was created from a Microsoft Defender for Cloud Apps alert. The SOC team wants to automatically block the user from further access and disable the user account in Microsoft Entra ID. You need to design an automated response using Microsoft Sentinel playbooks. The solution must minimize manual intervention. You have the following options: A) Create a playbook that triggers on the incident and uses the Microsoft Graph API to disable the user account and revoke sessions. Configure the playbook to run automatically from an automation rule. B) Create a playbook that triggers on the alert and uses the Defender for Cloud Apps API to suspend the user. Configure the automation rule to run the playbook on incident creation. C) Create a playbook that sends an email to the SOC team to manually disable the user. D) Create an automation rule that automatically changes the incident status to 'Active' and assigns it to a senior analyst. Which option should you choose?

Accepted Answer

Create a playbook that triggers on the incident and uses the Microsoft Graph API to disable the user account and revoke sessions. Configure the playbook to run automatically from an automation rule.. Option D is correct because it uses a playbook triggered on incident creation and leverages the Microsoft Graph API to disable the user account and revoke sessions, which directly addresses the compromised account in Microsoft Entra ID. This approach minimizes manual intervention by automating the entire response within Microsoft Sentinel, aligning with the requirement to block further access and disable the account automatically.

Answer

Create an automation rule that automatically changes the incident status to 'Active' and assigns it to a senior analyst.

Answer

Create a playbook that sends an email to the SOC team to manually disable the user.

Answer

Create a playbook that triggers on the alert and uses the Defender for Cloud Apps API to suspend the user. Configure the automation rule to run the playbook on incident creation.

Question 9

Your organization, Fabrikam, has a hybrid environment with on-premises Active Directory and Microsoft Entra ID. You are using Microsoft Sentinel and Microsoft Defender XDR. You have enabled Microsoft Defender for Identity (MDI) to protect on-premises Active Directory. Recently, you received an incident in Microsoft Sentinel indicating a potential DCSync attack from a domain controller. The incident was generated from an MDI alert. You need to investigate the incident and determine if the attack was successful. You have the following options: A) Use the Microsoft Sentinel incident investigation graph to view entities and relationships. Then query the IdentityDirectoryEvents table for the domain controller to see if any directory replication requests were made. B) Use the Microsoft Defender XDR advanced hunting to query the IdentityLogonEvents table for the domain controller. C) Use the Microsoft Sentinel workbook for MDI to visualize the attack timeline. D) Use the Microsoft Defender for Cloud Apps activity log to review the domain controller's activities. Which option should you choose?

Accepted Answer

Use the Microsoft Sentinel incident investigation graph to view entities and relationships. Then query the IdentityDirectoryEvents table for the domain controller to see if any directory replication requests were made.. Option C is correct because a DCSync attack involves an attacker impersonating a domain controller to request directory replication via the MS-DRSR protocol. The IdentityDirectoryEvents table in Microsoft Defender for Identity captures directory service replication activities, including the DirectoryReplication request action. Querying this table for the domain controller allows you to confirm if unauthorized replication requests were made, directly indicating a successful DCSync attack.

Answer

Use the Microsoft Sentinel workbook for MDI to visualize the attack timeline.

Answer

Use the Microsoft Defender XDR advanced hunting to query the IdentityLogonEvents table for the domain controller.

Answer

Use the Microsoft Defender for Cloud Apps activity log to review the domain controller's activities.

Question 10

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to ensure that an external user from a partner organization can access a specific Sentinel workbook without having access to the entire Log Analytics workspace. What should you do?

Accepted Answer

Use Azure AD B2B collaboration to invite the external user and assign the Sentinel Reader role on the workbook.. Azure AD B2B collaboration allows you to invite an external user from a partner organization into your Azure AD tenant. By assigning the Sentinel Reader role specifically on the workbook resource (not the workspace), the user can view the workbook without gaining access to the underlying Log Analytics workspace data or other Sentinel resources. This meets the requirement of granular, scoped access.

Answer

Create a new Log Analytics workspace dedicated to the external partner and deploy the workbook there.

Answer

Share the workbook as a shared dashboard in the Azure portal.

Answer

Add the external user to the resource group containing the workspace with Reader role.

Question 11

Refer to the exhibit. An automation rule in Microsoft Sentinel is configured as shown. When a high-severity incident is created, what is the expected behavior?

Accepted Answer

The task is created, then the playbook runs, but the incident modification fails because the owner is incorrectly formatted.. Option C is correct because the automation rule in Microsoft Sentinel executes actions sequentially. The task creation and playbook run succeed, but the incident modification fails because the owner field is incorrectly formatted. Sentinel expects the incident owner to be specified as a user principal name (UPN) or object ID, not a plain text string like 'SOC-Tier1'.

Answer

All actions execute successfully: task created, playbook runs, incident owner set to SOC-Tier1.

Answer

The rule fails to run because the actions are not in valid JSON format.

Answer

The playbook runs first, then the task is created, then the incident is modified.

Question 12

Your organization wants to use Microsoft Copilot for Security to generate incident summaries. What is the minimum license required?

Accepted Answer

Microsoft Copilot for Security standalone or add-on. Microsoft Copilot for Security is a standalone product that can be licensed independently or as an add-on to existing security subscriptions. It is not included in any Microsoft 365 or Defender plan by default; therefore, the minimum license required is either the standalone Copilot for Security SKU or the add-on license. This ensures the organization has the necessary entitlements to generate incident summaries using Copilot for Security.

Answer

Microsoft 365 E5

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Office 365 P2

Question 13

Your organization uses Microsoft Sentinel. You need to configure a playbook that automatically responds to incidents by creating a support ticket in ServiceNow. Which connector should you use?

Accepted Answer

ServiceNow connector. The ServiceNow connector is the correct choice because it provides a direct, pre-built integration between Microsoft Sentinel and ServiceNow, enabling automated creation of incidents or tickets in ServiceNow when a Sentinel incident is triggered. This connector uses the ServiceNow REST API to map Sentinel fields to ServiceNow ticket fields, eliminating the need for custom HTTP calls or additional middleware.

Answer

HTTP connector

Answer

Azure Monitor connector

Answer

Office 365 Outlook connector

Question 14

Refer to the exhibit. A KQL query is used in a Microsoft Sentinel scheduled analytics rule to detect unhealthy agents. The rule runs every 5 minutes and has a lookback period of 5 minutes. What is the potential issue?

Accepted Answer

The query may miss agents with no heartbeat in the last 5 minutes due to the lookback period matching the run frequency.. Option C is correct because the rule runs every 5 minutes with a 5-minute lookback, creating a gap: if an agent sends a heartbeat at 0:01 and the rule runs at 0:05, the heartbeat falls within the lookback window. However, if the agent misses a heartbeat cycle (e.g., heartbeat interval is 10 minutes), the rule may not detect the absence because the lookback window only covers the last 5 minutes, and the last heartbeat might be older than 5 minutes. This means agents with no heartbeat in the last 5 minutes could be missed, especially if the heartbeat interval is longer than the lookback period.

Answer

The query will return all computers as unhealthy because the threshold is too high.

Answer

The query will not return any results because Heartbeat data is not in the workspace.

Answer

The query will cause a runtime error because ago() is misused.

Question 15

Your organization uses Microsoft Defender for Cloud. You need to view a list of all security recommendations for your Azure subscriptions. Which blade should you use?

Accepted Answer

Recommendations. The Recommendations blade in Microsoft Defender for Cloud is the centralized hub that lists all security recommendations for your Azure subscriptions, including those from Azure Security Benchmark and custom initiatives. It provides a prioritized view of security posture improvements, such as remediating vulnerabilities or enabling encryption, directly actionable from the blade.

Answer

Workbooks

Answer

Regulatory Compliance

Answer

Inventory