SC-200 Manage a security operations environment Practice Test 16 — 15 Questions

Question 1

Your organization has recently deployed Microsoft Sentinel and wants to ensure that all critical Azure resources are monitored for security misconfigurations. You have already enabled Microsoft Defender for Cloud on all subscriptions. You need to configure a solution that will automatically create a Sentinel incident whenever a new security recommendation with severity 'High' is generated in Defender for Cloud. The incident should be assigned to the 'Infrastructure' team. Additionally, you want to run a playbook that will open a ticket in your IT Service Management (ITSM) tool. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable the Defender for Cloud connector, then create an automation rule that triggers on incident creation from the connector, assigns to 'Infrastructure', and runs a playbook.. The Defender for Cloud connector in Microsoft Sentinel ingests security recommendations and alerts as incidents. By creating an automation rule that triggers on incident creation from this connector, you can automatically assign incidents to the 'Infrastructure' team and run a playbook to open a ticket in your ITSM tool, fulfilling all requirements without custom queries or workbooks.

Answer

Use the Azure Activity connector to ingest recommendations, then create an analytics rule to generate incidents.

Answer

Enable the Defender for Cloud connector and create a workbook to monitor recommendations.

Answer

Create a custom analytics rule that queries the SecurityRecommendation table in the Log Analytics workspace.

Question 2

Your SOC team uses Microsoft Sentinel. You need to ensure that all incidents are classified and resolved within 72 hours. Currently, analysts manually update the incident status and classification. You want to automate the following: 1) If an incident is not updated within 48 hours, send a reminder to the assigned analyst via email. 2) If an incident remains open after 72 hours, automatically escalate it to the SOC manager and increase its severity. What should you implement?

Accepted Answer

Create automation rules with triggers on 'incident updated' and scheduled conditions to run playbooks for reminders and escalation.. Automation rules in Microsoft Sentinel can be configured to trigger on incident updates (e.g., when an incident is created or modified) and can include conditions that evaluate incident properties like 'last update time' and 'status'. Combined with scheduled playbooks (e.g., Logic Apps with recurrence trigger) that run periodically to check for incidents that haven't been updated in 48 hours or remain open after 72 hours, this approach automates reminders and escalation. Option A is incorrect because analytics rules are designed to generate new incidents from data, not to perform post-creation actions on existing incidents. Option B is incorrect because while Logic Apps can be used, the scenario requires integrating with automation rules for incident-based triggers, and a single Logic App alone would not efficiently handle the event-driven escalation without custom polling. Option C is incorrect because a single playbook cannot inherently run on a schedule; playbooks are triggered by automation rules or alerts, not directly on a recurring schedule for all existing incidents.

Answer

Create an analytics rule that runs every hour and queries for old incidents.

Answer

Use Azure Logic Apps with a recurrence trigger to query the Sentinel API and update incidents.

Answer

Create a single playbook that runs on a schedule and checks all incidents.

Question 3

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to ensure that a new SOC analyst can triage incidents without being able to delete or modify analytics rules. Which role should you assign?

Accepted Answer

Microsoft Sentinel Reader. Microsoft Sentinel Reader provides read-only access to Sentinel data, including incidents, workbooks, and analytics rules, but explicitly prevents any modifications or deletions. This role is ideal for SOC analysts who need to triage incidents without altering detection configurations. Security Reader and Global Reader lack Sentinel-specific incident triage permissions, while Security Operator allows modification of incidents, which exceeds the required scope.

Answer

Security Reader

Answer

Global Reader

Answer

Security Operator

Question 4

Your organization uses Microsoft Sentinel with a workspace in the East US region. You need to reduce data ingestion costs while retaining security events for one year. You have enabled Azure Monitor Agent on all servers. What should you do?

Accepted Answer

Configure a daily ingestion cap and enable Basic Logs for the workspace.. Configuring a daily ingestion cap limits the total data ingested per day, directly controlling costs. Enabling Basic Logs for the workspace allows you to store security events at a lower ingestion cost while retaining them for up to one year, as Basic Logs support up to 365 days of retention by default. This combination meets the requirement to reduce costs and retain security events for one year without losing data.

Answer

Configure a daily ingestion cap and enable archiving for data older than 90 days.

Answer

Set a daily ingestion cap and convert the workspace to Auxiliary Logs.

Answer

Reduce the data retention period to 90 days and set a daily ingestion cap.

Question 5

Which TWO actions can be performed using Microsoft Sentinel automation rules? (Choose two.)

Accepted Answer

Change the severity of an incident. Automation rules in Microsoft Sentinel allow you to automate incident management tasks, including changing the severity of an incident and adding tags. These actions are part of the incident-handling workflow and can be triggered when an incident is created or updated, enabling consistent triage and enrichment without manual intervention.

Answer

Deploy a data connector

Answer

Modify a watchlist

Answer

Create a scheduled query rule

Question 6

Which TWO conditions must be met to enable Microsoft Sentinel UEBA? (Choose two.)

Accepted Answer

Microsoft Entra ID P2 licenses must be assigned to users.. Microsoft Sentinel UEBA requires the SecurityInsights solution to be installed in the Log Analytics workspace, as this solution provides the UEBA data connectors and analytics rules. Additionally, Microsoft Entra ID P2 licenses are required because UEBA relies on the identity protection and risk detection capabilities that are only available with P2 licensing, enabling the enrichment of entity behavior profiles with risk data.

Answer

KQL queries must be created for entity behavior.

Answer

Microsoft Defender XDR must be onboarded.

Answer

Azure SQL Database must be deployed.

Question 7

Which THREE permissions are required for a user to manage Microsoft Sentinel playbooks using Azure Logic Apps? (Choose three.)

Accepted Answer

Microsoft Sentinel Contributor. Microsoft Sentinel Contributor is required because it grants the necessary permissions to create, update, and delete playbooks within Microsoft Sentinel, which are built on Azure Logic Apps. This role allows the user to manage playbooks as part of the security operations environment, including assigning playbooks to automation rules and incident triggers.

Answer

Global Administrator in Microsoft Entra ID

Answer

Reader on the Logic App

Question 8

You are reviewing a Microsoft Sentinel analytics rule configuration. The rule is not generating incidents as expected. What is the most likely cause?

Accepted Answer

The query references a table that is not available in the Sentinel workspace.. If the query in an analytics rule references a table that does not exist in the Microsoft Sentinel workspace, the rule will fail to execute or return no results, preventing incident generation. This is a common misconfiguration when migrating or authoring rules that depend on specific data connectors or schema that have not been onboarded.

Answer

The queryFrequency and queryPeriod are mismatched.

Answer

The suppressionDuration is set to 5 hours, suppressing alerts.

Answer

The action type 'MFA disabled' is not supported in IdentityLogonEvents.

Question 9

Your organization has recently deployed Microsoft Sentinel and wants to ensure that all critical Azure resources are monitored for security misconfigurations. You have already enabled Microsoft Defender for Cloud on all subscriptions. You need to configure a solution that will automatically create a Sentinel incident whenever a new security recommendation with severity 'High' is generated in Defender for Cloud. The incident should be assigned to the 'Infrastructure' team. Additionally, you want to run a playbook that will open a ticket in your IT Service Management (ITSM) tool. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Ensure the Microsoft Defender XDR connector is configured to include Defender for Cloud Apps incidents.. When Microsoft Defender XDR connector is enabled in Sentinel, it can ingest incidents from all Microsoft Defender products, including Defender for Cloud Apps, provided the connector's configuration includes the option to synchronize those incidents. Since the Defender for Cloud Apps connector is not listed separately, the correct approach is to verify and adjust the Microsoft Defender XDR connector's settings to include Defender for Cloud Apps incidents. Option D directly addresses this by ensuring the existing connector is configured to forward those incidents.

Answer

Enable the Microsoft Sentinel integration in the Defender for Cloud Apps portal.

Answer

Configure a data collection rule in Microsoft Purview to forward alerts to Sentinel.

Answer

Install the Microsoft Defender for Cloud Apps connector from Sentinel data connectors.

Question 10

Your organization uses Microsoft Sentinel with multiple workspaces for different business units. You need to provide a single-pane-of-glass view for incident management across all workspaces. You have deployed Azure Lighthouse to manage multiple workspaces from a single portal. The SOC team is able to see incidents from all workspaces, but when they try to investigate an incident by clicking on it, they receive a 'Resource not found' error. The team has the necessary permissions on the Sentinel resources. What is the most likely cause of this error?

Accepted Answer

The user does not have the 'Microsoft Sentinel Contributor' role on the subscription containing the workspace.. The 'Resource not found' error when clicking an incident in a cross-workspace view typically occurs because the user lacks the 'Microsoft Sentinel Contributor' role at the subscription level that contains the workspace. While Azure Lighthouse enables cross-workspace visibility, each workspace's Sentinel resources require the user to have the Contributor role on the subscription (or at least the resource group) to access incident details, not just the workspace itself. Without this role, the portal cannot resolve the resource path for the incident.

Answer

The workspace is in a different Azure region.

Answer

Cross-workspace queries are not enabled in Sentinel.

Answer

The incidents are generated by analytics rules that are not deployed in the user's workspace.

Question 11

You are the security operations lead for a multinational company using Microsoft Sentinel. You have deployed a custom analytics rule that uses a KQL query to detect anomalous outbound network traffic. The rule runs every hour and looks back 24 hours. Recently, the rule has been generating a high number of false positives. You need to tune the rule to reduce false positives without missing genuine threats. The rule currently triggers when the count of outbound connections to a single IP exceeds 100 in an hour. You analyze the data and find that legitimate cloud services often trigger the rule. What should you do?

Accepted Answer

Modify the KQL query to exclude traffic to known benign IP ranges.. Modifying the KQL query to exclude traffic to known benign IP ranges directly reduces false positives from legitimate cloud services while keeping the detection logic intact. Option A is incorrect because disabling the rule and creating a new one is not a tuning approach and may lead to missed threats. Option B is incorrect because increasing the threshold to 200 connections per hour may still allow some false positives or could miss genuine anomalies that exceed the lower threshold. Option C is incorrect because configuring a suppression rule only hides incidents from those IPs, which does not reduce the underlying false positives and can cause genuine threats from those IPs to be overlooked.

Answer

Disable the rule and create a new one with a different query.

Answer

Increase the threshold to 200 connections per hour.

Answer

Configure a suppression rule to automatically close incidents from those IPs.

Question 12

Your organization uses Microsoft Sentinel with UEBA enabled. You are investigating a suspicious incident where a user's account is reported to have accessed an unusual amount of data from a SharePoint site. The incident alert points to the user 'jdoe@contoso.com'. You open the incident and see that the entity timeline for jdoe shows several activities, including file downloads. However, you notice that the timeline does not include any Azure AD sign-in events for this user. You need to include sign-in events in the entity timeline to get a complete picture. What should you do?

Accepted Answer

Install the Azure Active Directory connector to ingest sign-in logs.. The entity timeline in Microsoft Sentinel relies on data already ingested into the workspace. Since Azure AD sign-in events are not appearing, the most likely cause is that the Azure Active Directory connector has not been installed or configured. Installing this connector ingests sign-in logs (and audit logs) into Sentinel, which then populates the entity timeline with sign-in activities for users like jdoe.

Answer

Enable UEBA for Azure AD in the Sentinel settings.

Answer

Install the Office 365 connector to ingest Azure AD logs.

Answer

Configure the entity timeline to include Azure AD events manually.

Question 13

You are a security analyst at a company that uses Microsoft Defender XDR. You receive an alert about a potential ransomware activity on a workstation. The alert is generated by Microsoft Defender for Endpoint. You need to contain the threat by isolating the workstation from the network while allowing forensic analysis to proceed. You want to use Microsoft Defender XDR's built-in actions. What should you do?

Accepted Answer

Use the 'Isolate device' action from the Microsoft Defender XDR portal.. The 'Isolate device' action in Microsoft Defender XDR (specifically from the Microsoft Defender for Endpoint component) disconnects the device from all network traffic except for the Defender for Endpoint service and a few authorized services (such as Windows Update and the Microsoft Update Service). This allows forensic analysis tools (like Live Response) to continue communicating with the device while preventing the ransomware from spreading laterally or communicating with command-and-control servers. This is the built-in, recommended containment action for such scenarios.

Answer

Create a firewall rule in Microsoft Defender for Cloud Apps to block the device's IP.

Answer

Unenroll the device from Microsoft Intune.

Answer

Disable the network adapter on the workstation remotely.

Question 14

Your company uses Microsoft Sentinel to monitor security events. You have configured a daily email report that summarizes the top 10 incidents from the past 24 hours. The report is sent using a Logic App playbook triggered by a scheduled query. Recently, the report has stopped being delivered. You check the Logic App run history and see that the last run failed with an HTTP 403 error when connecting to the Microsoft Sentinel API. The Logic App uses a managed identity for authentication. What is the most likely cause of the failure?

Accepted Answer

The managed identity does not have the required permissions on the Sentinel workspace.. The HTTP 403 error indicates a permissions failure when the Logic App attempted to call the Microsoft Sentinel API. Since the Logic App uses a managed identity for authentication, the most likely cause is that the managed identity lacks the necessary role assignments on the Sentinel workspace, such as 'Microsoft Sentinel Contributor' or 'Microsoft Sentinel Reader', which are required to query incidents via the API.

Answer

The managed identity's client ID has changed.

Answer

The Logic App is not connected to Microsoft Entra ID.

Answer

The scheduled query is no longer running.

Question 15

Your organization has Microsoft Sentinel deployed in a single workspace. You need to implement role-based access control (RBAC) so that only senior analysts can modify analytics rules, while junior analysts can only view incidents. You have created custom roles in Azure. You assign the junior analysts the 'Microsoft Sentinel Reader' role. However, you find that junior analysts can still create and modify analytics rules. What is the most likely reason?

Accepted Answer

The junior analysts have been assigned the 'Contributor' role on the resource group containing the workspace.. The most likely reason is that the junior analysts have been assigned the 'Contributor' role on the resource group containing the workspace. The 'Contributor' role at the resource group scope grants full access to manage all resources within that resource group, including the Microsoft Sentinel workspace. This permission overrides the 'Microsoft Sentinel Reader' role assigned at the workspace level because Azure RBAC allows multiple role assignments, and effective permissions are the union of all assigned roles. Therefore, the junior analysts can create and modify analytics rules due to the Contributor role. Option A is incorrect because the Microsoft Sentinel Reader role does exist and provides read-only access. Option B is incorrect because group membership itself does not grant additional permissions unless the group has a role assignment; even if it did, the Contributor role at a higher scope would still override. Option D is incorrect because built-in roles are sufficient; custom roles are not necessary in this scenario.

Answer

The 'Microsoft Sentinel Reader' role does not exist; you used the wrong role.

Answer

The junior analysts are members of a group that has a role assignment on the workspace.

Answer

You need to create a custom role instead of using built-in roles.