SC-200 Manage a security operations environment Practice Test 16 — 15 Questions

Question 1

Which THREE components are required to implement a threat intelligence feed in Microsoft Sentinel using the Threat Intelligence - TAXII data connector?

Accepted Answer

Root collection ID. The root collection ID is a required component for the Threat Intelligence - TAXII data connector because it identifies the specific collection of threat indicators on the TAXII server. Without this ID, Microsoft Sentinel cannot determine which set of indicators to ingest, as a single TAXII server may host multiple collections. The connector uses the root collection ID to query the correct STIX/TAXII endpoint and retrieve the relevant threat intelligence feed.

Answer

A Log Analytics workspace with Microsoft Sentinel enabled

Answer

A watchlist named 'ThreatIntelligenceIndicators'

Question 2

Which TWO actions can a Microsoft Sentinel automation rule perform when an incident is created?

Accepted Answer

Run a playbook. Microsoft Sentinel automation rules can trigger actions when an incident is created, including running a playbook (Option C) and changing the incident severity (Option D). Playbooks are automated workflows based on Azure Logic Apps that can perform complex response actions, while severity changes allow dynamic triage based on incident properties.

Answer

Create a new analytics rule

Answer

Query Log Analytics workspaces

Answer

Ingest data from a new source

Question 3

Refer to the exhibit. You are reviewing a Microsoft Sentinel scheduled analytics rule defined in JSON. The rule is intended to trigger an incident when more than 5 sign-ins from anomalous locations occur within an hour. However, the rule is not triggering as expected. What is the most likely cause?

Accepted Answer

The query references a column that does not exist in the SigninLogs table.. The query references a column that does not exist in the SigninLogs table. In Microsoft Sentinel, if a scheduled analytics rule's KQL query references a non-existent column, the query will fail silently or return no results, preventing the rule from triggering an incident. The rule logic depends on the query returning a result set that meets the trigger threshold, and a missing column causes the query to fail or return zero rows.

Answer

The severity is set to 'Medium', but it must be an integer.

Answer

The triggerThreshold is set to 5, but it should be a string like '5'.

Answer

The queryFrequency and queryPeriod are set to the same value, which is not allowed.

Question 4

Refer to the exhibit. You are analyzing a KQL query used in a custom detection rule in Microsoft Defender XDR. The rule is supposed to detect devices where a parent process launched more than 10 instances of PowerShell or cmd.exe in the last 7 days. However, the query returns no results even though you know such activity exists. What is the most likely reason?

Accepted Answer

The 'extend' line uses a column that does not exist in the DeviceProcessEvents schema.. The 'extend' line references a column named 'ParentProcessFileName' that does not exist in the DeviceProcessEvents schema. The actual column is 'InitiatingProcessFileName' (or 'ParentProcessName' in some schemas). Since the column doesn't exist, the 'extend' operation fails silently or produces null values, causing the subsequent 'summarize' to group by null and return no results.

Answer

The 'extend' line creates a new column that is not used in the subsequent summarize, causing the query to not group by parent process as intended.

Answer

The 'summarize' operator cannot be used with 'count()' in this context.

Answer

The 'where' clause filters out all events because the FileName list is incorrect.

Question 5

A SOC analyst receives a high-severity alert for a user who downloaded a malicious file from a phishing email. The analyst needs to quickly assess the scope of the incident across endpoints, email, and identities. Which Microsoft Defender XDR feature should the analyst use to get a unified view of the incident?

Accepted Answer

Microsoft Defender XDR incident queue. The Microsoft Defender XDR incident queue is the correct choice because it aggregates alerts from Microsoft Defender for Endpoint, Office 365, and Identity into a single incident view, enabling the analyst to correlate the malicious file download across endpoints, email, and user identities without switching consoles. This unified incident management is a core feature of Microsoft Defender XDR, designed specifically for rapid triage and scope assessment in multi-domain threats.

Answer

Microsoft Purview compliance portal

Answer

Microsoft Intune device compliance dashboard

Answer

Microsoft Sentinel incidents blade

Question 6

Your organization uses Microsoft Sentinel for security operations. You need to ensure that critical alerts are automatically assigned to the appropriate SOC tier for investigation. What should you configure in Microsoft Sentinel?

Accepted Answer

Create an automation rule that sets the incident owner. Automation rules in Microsoft Sentinel allow you to automatically assign incidents to specific owners based on conditions like severity or alert type. This ensures critical alerts are routed to the appropriate SOC tier without manual intervention, directly meeting the requirement.

Answer

Create a playbook that assigns the incident to a user

Answer

Use a watchlist to map alert types to owners

Answer

Configure an analytics rule to set the owner

Question 7

A SOC manager wants to implement a new workflow where high-severity Microsoft Defender for Cloud Apps alerts are automatically sent to a Teams channel for immediate action. The solution must not require custom code. What should the manager configure?

Accepted Answer

Create an automation rule in Microsoft Sentinel with a playbook that posts to Teams. Microsoft Sentinel's automation rules can trigger a playbook (built on Azure Logic Apps) when a high-severity alert is generated, and the playbook can post a message to a Teams channel without requiring custom code. This directly meets the requirement of automatically sending high-severity Microsoft Defender for Cloud Apps alerts to Teams for immediate action, leveraging built-in connectors.

Answer

Use Microsoft Power Automate to monitor the alerts and send a Teams message

Answer

Configure a rule in Microsoft Defender XDR to send email notifications

Answer

Configure Microsoft Entra ID to send the alerts to Teams

Question 8

Your company uses Microsoft Defender for Endpoint (MDE) and Microsoft Sentinel. You need to ensure that when a device is determined to be compromised, the device is automatically isolated from the network and a Sentinel incident is updated with the isolation status. What is the most efficient way to achieve this?

Accepted Answer

Create a Microsoft Sentinel automation rule with a playbook that isolates the device and updates the incident. It leverages Microsoft Sentinel's automation capabilities to respond to security incidents without manual intervention. By creating an automation rule that triggers a playbook (an Azure Logic Apps workflow), you can automatically isolate a compromised device via Microsoft Defender for Endpoint APIs and simultaneously update the Sentinel incident with the isolation status. This provides the most efficient, end-to-end automated response directly within the security operations workflow.

Answer

Have the SOC analyst manually isolate the device from the MDE console and update the incident in Sentinel

Answer

Configure Microsoft Intune to automatically isolate the device when a compliance policy is violated

Answer

Use Microsoft Defender XDR conditional access to block the device

Question 9

Your organization has deployed Microsoft Sentinel and Microsoft Defender XDR. You need to ensure that all Defender XDR incidents are automatically synchronized into Microsoft Sentinel for a single pane of glass. What should you configure?

Accepted Answer

Enable the Microsoft Sentinel data connector for Microsoft Defender XDR. The Microsoft Sentinel data connector for Microsoft Defender XDR is the native integration that automatically synchronizes all Defender XDR incidents into Sentinel. This connector ingests incidents, alerts, and evidence from Defender XDR into the Sentinel workspace, enabling a single pane of glass without requiring custom scripting or manual workflows.

Answer

Use Microsoft Graph API to sync incidents daily

Answer

Create an automation rule in Microsoft Sentinel to create incidents from Defender XDR alerts

Answer

Configure Microsoft Defender XDR to forward incidents to Sentinel using a webhook

Question 10

A security operations center (SOC) uses Microsoft Sentinel for log management. The SOC manager wants to reduce storage costs by automatically archiving logs that are older than 90 days to long-term retention, but retains the ability to search them if needed. What should the manager configure?

Accepted Answer

Configure a data archiving policy in the Log Analytics workspace to archive logs after 90 days. Configuring a data archiving policy in the Log Analytics workspace automatically moves logs older than 90 days to long-term, low-cost storage while keeping them searchable via the search job or restore feature. This directly meets the SOC manager's requirement to reduce costs without losing the ability to query archived data.

Answer

Change the table plan to Basic Logs for logs older than 90 days

Answer

Create a retention policy that deletes logs older than 90 days

Answer

Export logs older than 90 days to an Azure Storage account

Question 11

Your SOC team uses Microsoft Sentinel incident investigation. An analyst needs to quickly see all related entities (users, IPs, machines) for an incident. Which feature should the analyst use?

Accepted Answer

Incident investigation graph. The Incident investigation graph in Microsoft Sentinel provides a visual, interactive map of all entities (users, IPs, machines) linked to an incident, allowing analysts to quickly see relationships and pivot between entities. This is the dedicated feature for entity-centric incident exploration, unlike other options that serve different purposes.

Answer

Incident timeline

Answer

Hunting blade

Answer

Entity behavior analytics page

Question 12

A SOC analyst suspects a user account is compromised based on anomalous sign-in activity detected by Microsoft Entra ID Protection. The analyst needs to confirm and contain the threat. What is the first action the analyst should take?

Accepted Answer

Review the user's risk level and sign-in logs in Microsoft Entra ID Protection. The first step when investigating a potential account compromise is to review the user's risk level and sign-in logs in Microsoft Entra ID Protection. This allows the analyst to confirm the threat by examining risk detections, sign-in patterns, and contextual details before taking any containment actions. Prematurely resetting passwords or disabling accounts could disrupt legitimate user activity or alert the attacker without a full understanding of the scope.

Answer

Reset the user's password immediately

Answer

Disable the user account in Microsoft Entra ID

Answer

Block the user's sign-in from all locations

Question 13

Which TWO actions can be performed using Microsoft Sentinel automation rules? (Select TWO.)

Accepted Answer

Assign an incident to a specific SOC analyst. Automation rules in Microsoft Sentinel allow you to automate incident management tasks, such as assigning incidents to specific SOC analysts based on criteria like severity or type. This is a core capability of automation rules, which can set the owner of an incident to a specific user or group, enabling efficient triage and accountability.

Answer

Modify a data connector's configuration

Answer

Create a new analytics rule

Answer

Create a new watchlist

Question 14

Which THREE capabilities are provided by Microsoft Sentinel's UEBA (User and Entity Behavior Analytics)? (Select THREE.)

Accepted Answer

Identify users whose behavior deviates from their peers. Microsoft Sentinel's UEBA uses machine learning models to establish a baseline of normal behavior for each user and then compares individual user activity against peer group behavior. When a user's actions deviate significantly from their peers, such as accessing unusual resources or performing atypical data transfers, an anomaly is generated, enabling security analysts to investigate potential insider threats or compromised accounts.

Answer

Automatically run playbooks when anomalies are detected

Answer

Create watchlists for high-value users

Question 15

Which TWO actions can be taken directly from the Microsoft Defender XDR incident queue? (Select TWO.)

Accepted Answer

Isolate a device involved in the incident. The Microsoft Defender XDR incident queue provides direct actions, including device isolation, to contain threats without navigating to separate device management consoles. This capability is built into the incident investigation pane, allowing security analysts to quickly isolate a device involved in an incident from the unified queue.

Answer

Modify a data connector's log collection

Answer

Create a new analytics rule

Answer

Create an automation rule