SC-200 Manage a security operations environment Practice Test 17 — 15 Questions

Question 1

Refer to the exhibit. You are reviewing an automation rule configuration in Microsoft Sentinel. Based on the JSON snippet, what will happen when a high-severity incident is created?

Accepted Answer

The rule will run a playbook when a high-severity incident is created. The automation rule's trigger condition is set to 'When incident is created' and the condition filters for incidents with a severity of 'High'. When a high-severity incident is created, the rule will execute the associated playbook, which is a common use case for automated response in Microsoft Sentinel.

Answer

The rule will change the severity of the incident to Medium

Answer

The rule will assign the incident to the SOC manager

Answer

The rule will run the playbook when a new alert is created

Question 2

Refer to the exhibit. You are investigating a user entity in Microsoft Sentinel. The entity details show a riskLevel of 'high' and riskState 'atRisk'. What does this indicate?

Accepted Answer

The user account has been flagged by Microsoft Entra ID Protection as at risk. The riskLevel of 'high' and riskState of 'atRisk' are specific properties populated by Microsoft Entra ID Protection (formerly Azure AD Identity Protection). These values indicate that the user account has been flagged as risky based on real-time risk detections (e.g., leaked credentials, anonymous IP address, atypical travel). This is not a direct result of a Sentinel analytics rule, nor does it mean the account is disabled or confirmed compromised—it means the identity protection service has detected suspicious activity and assigned a risk level.

Answer

The user account has been disabled

Answer

The user account triggered a Sentinel analytics rule

Answer

The user account has been confirmed compromised

Question 3

Refer to the exhibit. A SOC analyst runs this KQL query in Microsoft Sentinel. What is the purpose of this query?

Accepted Answer

Find users with more than 5 failed sign-ins from an IP address in the last hour. The KQL query filters for events where the result type is 'Failure' (failed sign-ins), then groups by account and IP address, counting occurrences. The `where count_ > 5` clause ensures only accounts with more than 5 failed sign-ins from a single IP are returned, which is a classic indicator of a brute force attack. This directly matches option D.

Answer

Detect brute force attempts by finding users with many failed sign-ins from a single IP

Answer

List all successful sign-ins in the last hour

Answer

Identify users who successfully signed in from multiple IPs

Question 4

Your organization uses Microsoft Sentinel for security operations. You need to ensure that a specific AWS CloudTrail log is ingested into Microsoft Sentinel. Which data connector should you use?

Accepted Answer

Amazon Web Services S3 Connector. The Amazon Web Services S3 Connector is the correct choice because AWS CloudTrail logs are stored as JSON files in an S3 bucket. Microsoft Sentinel ingests these logs by connecting directly to the S3 bucket, reading the CloudTrail log files, and pulling them into the Log Analytics workspace. The AWS CloudTrail Connector, by contrast, is a legacy connector that requires a separate AWS Lambda function and is deprecated in favor of the S3 connector.

Answer

AWS CloudTrail Connector

Answer

Azure Functions (AWS)

Answer

AWS Security Hub Connector

Question 5

Your security team receives alerts from Microsoft Defender for Cloud. You need to configure automated response to remediate a specific alert type. What should you create in Microsoft Sentinel?

Accepted Answer

An automation rule. In Microsoft Sentinel, automation rules are the correct mechanism to define automated responses triggered by alerts, including those from Microsoft Defender for Cloud. They allow you to run playbooks, change incident severity, assign ownership, or add comments when a specific alert type fires, enabling remediation without manual intervention.

Answer

An analytics rule

Answer

A workbook

Answer

A watchlist

Question 6

You are managing a Microsoft Sentinel workspace that ingests data from Microsoft 365 Defender. You notice that some incident creation rules are not generating incidents as expected. What should you check first?

Accepted Answer

The Microsoft 365 Defender data connector. The Microsoft 365 Defender data connector is the correct first check because it is the ingestion pipeline for security alerts from Microsoft 365 Defender into Microsoft Sentinel. If this connector is misconfigured, disconnected, or has stopped syncing, incident creation rules that depend on these alerts will not trigger, even if the analytics rules themselves are enabled and correctly configured.

Answer

The workspace daily usage cap

Answer

The SecurityIncident table schema

Answer

The analytics rule status

Question 7

Which TWO actions should you take when configuring Microsoft Sentinel to minimize false positives from an analytics rule?

Accepted Answer

Map entities correctly. Option B (Map entities correctly) is correct because accurate entity mapping (for example, mapping Account, Host, or IP custom entities in the rule's entity mapping section) lets Sentinel correlate and enrich alerts with the right context, so benign activity isn't misattributed and duplicate or unrelated alerts aren't generated. Option D (Adjust the rule's query threshold) is correct because tuning the rule's KQL query — for example, raising the count or time-window threshold, filtering known-good accounts, or adding exclusions — directly reduces the volume of low-fidelity matches that become false-positive incidents. Option A is not a false-positive reduction measure; a playbook that auto-closes low-severity alerts only handles alerts after they are created and does not stop them from firing. Option C (Enable incident creation automatically) actually increases noise by turning every matching alert into an incident rather than suppressing false positives. Option E (Configure alert grouping) consolidates related alerts into fewer incidents but does not reduce the underlying false-positive detections.

Answer

Add a playbook to automatically close low-severity alerts

Answer

Enable incident creation automatically

Answer

Configure alert grouping

Question 8

Which THREE of the following are valid methods to archive logs in Microsoft Sentinel to reduce costs?

Accepted Answer

Configure continuous export to Azure Data Lake Storage Gen2. Microsoft Sentinel supports continuous export of logs to Azure Data Lake Storage Gen2, which allows you to retain raw log data at lower storage costs while still being able to query it using Azure Synapse or other analytics tools. This method reduces the cost of high-volume log retention in Sentinel's native workspace by moving data to a cheaper long-term storage tier.

Answer

Set the workspace to free tier

Answer

Enable Basic Logs ingestion for all tables

Question 9

Which TWO permissions are required for a user to manage Microsoft Sentinel playbooks?

Accepted Answer

Logic App Contributor. Microsoft Sentinel playbooks are built on Azure Logic Apps, so managing them requires the Logic App Contributor role to create, edit, and delete the underlying logic app resources. Additionally, Microsoft Sentinel Contributor is needed to attach playbooks to analytics rules or automation rules within Sentinel, as this involves modifying Sentinel-specific configurations. Without both roles, a user cannot fully manage playbooks in the Sentinel context.

Answer

Microsoft Sentinel Reader

Answer

Automation Operator

Answer

Global Administrator

Question 10

Refer to the exhibit. You run the KQL query in Microsoft Sentinel to identify analysts with high incident assignments. The query returns no results, but you know incidents exist. What is the most likely reason?

Accepted Answer

Incidents are not assigned to any owner, so the Owner field is null. If incidents have no assigned owner, the Owner field is null. The KQL query likely filters or groups by Owner, and null values are excluded from results by default in aggregation operations like summarize. Since incidents exist but are unassigned, the query returns no results.

Answer

The summarize operator is incorrectly used

Answer

The SecurityIncident table does not exist

Answer

The query period is too short to capture incidents

Question 11

Refer to the exhibit. You execute the Azure CLI command to create an analytics rule in Microsoft Sentinel. The rule is created but never triggers. What is the most likely cause?

Accepted Answer

The query references a column that does not exist in SigninLogs. If the KQL query in the analytics rule references a column that does not exist in the SigninLogs table, the query will run but return zero results (or an error depending on the query structure), causing the rule to never trigger an alert. In Microsoft Sentinel, analytics rules rely on the query to produce matching results; if the column name is misspelled or absent, no events will match the rule conditions, so no incidents are generated.

Answer

The --enabled parameter should be set to false

Answer

The severity must be set to Low for the rule to trigger

Answer

The resource group name is incorrect

Question 12

Your organization uses Microsoft Defender for Identity (MDI) to monitor on-premises Active Directory. You want to forward MDI alerts to Microsoft Sentinel. What should you configure?

Accepted Answer

Microsoft Defender for Identity connector. Microsoft Defender for Identity (MDI) alerts are forwarded to Microsoft Sentinel by configuring the Microsoft Defender for Identity data connector. This connector ingests MDI security alerts, such as suspicious Kerberos activity or lateral movement attempts, directly into Sentinel for advanced correlation and incident response. The connector uses the Microsoft Graph Security API to pull alerts from the MDI service, enabling seamless integration without additional agents.

Answer

Microsoft 365 Defender connector

Answer

Azure Advanced Threat Protection connector

Answer

Microsoft Defender for Cloud Apps connector

Question 13

You are responsible for Microsoft Sentinel pricing. You notice that data ingestion costs are high due to verbose logs from Windows security events. You need to reduce costs while still collecting critical security events. What should you do?

Accepted Answer

Configure Windows Security Events via AMA connector with event filtering. The Azure Monitor Agent (AMA) connector for Windows Security Events allows granular filtering of event IDs and levels, enabling you to collect only critical security events (e.g., 4624, 4625) while excluding verbose logs like Event ID 5156 (Windows Filtering Platform permit connections). This reduces ingestion volume and cost without losing essential security visibility.

Answer

Use Common Event Format (CEF) connector instead of Windows Events

Answer

Change the table plan to Basic Logs

Answer

Increase the workspace retention period to archive warm data

Question 14

Your team uses Microsoft Sentinel workbooks to visualize security data. You want to allow team members to customize a workbook without affecting the original. What should you do?

Accepted Answer

Create a copy of the workbook and save it as a custom workbook. Creating a copy of the workbook and saving it as a custom workbook allows team members to modify their own version without altering the original. In Microsoft Sentinel, workbooks are based on Azure Monitor Workbooks, and saving a copy creates an independent resource with its own settings and queries. This preserves the original workbook for reference or reuse while enabling customization.

Answer

Edit the original workbook to add personalization

Answer

Assign the team the Microsoft Sentinel Reader role

Answer

Share the workbook directly with the team

Question 15

Which THREE are valid incident management features in Microsoft Sentinel?

Accepted Answer

Incident creation from analytics rules. Incident creation from analytics rules is a core feature in Microsoft Sentinel. When an analytics rule detects a threat or suspicious activity, it automatically generates an incident, which serves as the primary object for investigation and response. This automation is fundamental to Sentinel's security orchestration, automation, and response (SOAR) capabilities.

Answer

Incident merging

Answer

Incident templates